TeamDavid Webbox vulnerabilities

The Webbox application by Tobit Laboratories AG TeamDavid exposes a functionality that allows the server to be shut down when accessing the /internalRestart endpoint. This endpoint is accessible to unauthenticated users over the public internet. Instead of restarting, the server shuts down completely, enabling a remote attacker to cause persistent denial of service without authentication.

The Webbox application by Tobit Laboratories AG TeamDavid has an API endpoint vulnerable to a buffer overflow. By submitting a specially crafted JSON body, an unauthenticated attacker can crash the server, resulting in denial of service. Depending on stack state, this could potentially lead to remote code execution and full server compromise.

The Webbox application by Tobit Laboratories AG TeamDavid has an endpoint //serverClient_close.html vulnerable to a buffer overflow in multiple form data parameters. By submitting excessively long values, an authenticated attacker can crash the server, causing denial of service. This could potentially be exploited for remote code execution and full server compromise.

The Webbox application by Tobit Laboratories AG TeamDavid has file upload functionalities vulnerable to a buffer overflow. Specifying an excessively long filename can crash the server, causing denial of service. This could potentially be exploited for remote code execution and full server compromise.

The Webbox application by Tobit Laboratories AG TeamDavid has a memory leak vulnerability to an unauthorized actor. Accessing the URL “/.well-known/mta-sts.” causes the application to respond with memory. Repeated requests can expose sensitive information, including user passwords. Exploitation does not require authentication.

Tobit Laboratories AG TeamDavid's Webbox uses a hard-coded cryptographic key vulnerability. Passwords for locally created users in David are stored in various files using only obfuscation, so any user with access to the server's file system or who can extract files can potentially obtain affected users' passwords.

Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS) vulnerability. By sending a specially crafted link including an arbitrary path, an XSS payload or the parameter “EntryInfo”, and the parameter “!templateName=entryMail”, an attacker can cause the payload to execute in the victim’s browser when they click the link. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded newlines (“%0a”) or colons, attackers can inject additional headers including extra Location headers into the server’s response. This results e.g. in an open redirect vulnerability. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

Tobit Laboratories AG TeamDavid's Webbox application has a buffer overflow vulnerability in password change functionality triggered by including "(editini)" in the file path. The application does not verify that the provided path actually refers to an "Archive.ini" file, allowing an attacker to specify a different file with excessive size. An unauthenticated attacker can crash the server, resulting in denial of service.

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper validation or restriction on file types. As a result, an attacker can create files (e.g., .htm) containing malicious JavaScript code. When a user accesses a file created in this way, stored cross-site scripting is triggered. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed.

Tobit Laboratories AG TeamDavid's Webbox's move archive functionality (“!ArcEntryMove”) accepts an arbitrary path, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables authenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). If outbound connections to port 445 (SMB) are permitted, attackers can use this to conduct SMB relay or credential theft attacks. Exploitation of the “pathname” parameter is possible without authentication. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

Tobit Laboratories AG TeamDavid's Webbox's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables authenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). If outbound connections to port 445 (SMB) are permitted, attackers can use this to conduct SMB relay or credential theft attacks. Exploitation of the “pathname” parameter is possible without authentication. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

Tobit Laboratories AG TeamDavid's Webbox search functionality accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables unauthenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). If outbound connections to port 445 (SMB) are permitted, attackers can use this to conduct SMB relay or credential theft attacks. Exploitation is possible without authentication. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default.

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive creation functionality. Because the archive path is user-controlled and insufficiently validated, an attacker can manipulate the input to traverse directories. This allows the creation of folders in arbitrary locations, including sensitive directories such as C:\Windows or for different users. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default.

Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks when serving these log files. As a result, attackers can obtain sensitive error information or internal application details, potentially aiding in further attacks. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to local file inclusion in the send email, fax, SMS functionality. By specifying an '@@attach' command in the 'scjob' form field, files can be attached and downloaded by an authenticated user. The filter restricting access to the David config folder and user folder can be bypassed using alternate data streams, allowing download of sensitive files like other users' access files with passwords or the server's private key.

The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” (representing a dot), an attacker can manipulate the portion of the URL following the top-level domain (TLD). If a similar, registerable TLD exists (for example, if “.com” is the application’s domain, and “.company” is available for registration), an attacker can craft a URL to redirect users to a malicious “.company” domain. By using URL-encoded line feeds, it becomes possible to insert arbitrary response headers in the server's HTTP response. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to arbitrary file deletion in the send email, fax, SMS functionality. By specifying an '@@COMMENTFILE' command in the 'scjob' form field, any file on the system can be deleted.