TeamDavid Webbox vulnerabilities

The TeamDavid Webbox application exposes an endpoint /internalRestart that allows the server to be shut down. The endpoint is accessible to unauthenticated users over the public internet, and instead of restarting, the server completely shuts down. An attacker can trigger a persistent denial of service, and recovery requires manual administrator intervention.

An API endpoint in the TeamDavid Webbox application is vulnerable to a buffer overflow. Submitting a specially crafted JSON body (at least 8 characters long and starting with a number) by an unauthenticated attacker can cause the server to crash, resulting in denial of service. Depending on stack state or if a stack canary can be disclosed, this buffer overflow could potentially lead to remote code execution and full compromise of the server.

The //serverClient_close.html endpoint in the TeamDavid Webbox application is vulnerable to a buffer overflow in multiple form data parameters. Submitting excessively long values in these parameters by an authenticated attacker can trigger a server crash, resulting in denial of service. Depending on stack state or if a stack canary can be disclosed, this buffer overflow could potentially be exploited for remote code execution, leading to full compromise of the server.

File upload functionalities in the TeamDavid Webbox application are vulnerable to a buffer overflow. Specifying an excessively long filename in a file upload request by an unauthenticated attacker can trigger a crash of the server, resulting in denial of service. Depending on stack state or if a stack canary can be disclosed, this buffer overflow could potentially be exploited for remote code execution, leading to full compromise of the server.

The TeamDavid Webbox application has a memory leak vulnerability that allows an unauthorized actor to read sensitive information. Accessing the URL “/.well-known/mta-sts.” causes the application to respond with memory content. By repeatedly requesting this endpoint, an attacker can access sensitive information, including user passwords. Exploitation does not require authentication.

The TeamDavid Webbox application uses a hard-coded cryptographic key. Passwords for users created locally in David are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can otherwise extract files from the server (see vulnerability “Random File Read”), can potentially obtain affected users’ passwords.

Stored XSS vulnerability in TeamDavid Webbox. An attacker can send an email containing malicious JavaScript code, which executes when a user accesses the email.

Reflected XSS vulnerability in TeamDavid Webbox. By sending a specially crafted link including an arbitrary path, an XSS payload or the parameter 'EntryInfo', and the parameter '!templateName=entryMail', an attacker can cause the payload to execute in the victim's browser when they click the link.

Open redirect vulnerability in TeamDavid Webbox via the 'replyUrl' parameter. An attacker can craft a URL within the application that redirects the user's browser to an arbitrary third-party site, which can be abused for phishing attacks.

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the "cType" URL parameter, allowing arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded newlines ("%0a") or colons, attackers can inject additional headers including extra Location headers into the server's response, resulting in an open redirect vulnerability. This issue affects TeamDavid through Rollout 524.

The TeamDavid Webbox application handles password changes using a function triggered by including the string "(editini)" in the file path, writing the new password to the specified "Archive.ini" file. However, the application does not verify that the provided path actually refers to an "Archive.ini" file. If an attacker specifies a different file with excessive size, a buffer overflow occurs. This vulnerability allows an unauthenticated attacker to crash the server, resulting in denial of service.

The TeamDavid Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper validation or restriction on file types. As a result, an attacker can create files (e.g., .htm), containing malicious JavaScript code. When a user accesses a file created in this way, stored cross-site scripting is triggered.

TeamDavid's Webbox move archive functionality ("!ArcEntryMove") accepts an arbitrary path, which can be set to network locations using UNC paths (e.g., "\\Server\Share"). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables authenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). Exploitation of the "pathname" parameter is possible without authentication. This issue affects TeamDavid through Rollout 524.

TeamDavid's Webbox sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths (e.g., "\\Server\Share"). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables authenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). Exploitation of the "pathname" parameter is possible without authentication. This issue affects TeamDavid through Rollout 524.

TeamDavid's Webbox link storing functionality (//ServerClient_celink.htm) accepts a "pathname" parameter, which can be set to network locations using UNC paths (e.g., "\\Server\Share"). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables authenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). Exploitation of the "pathname" parameter is possible without authentication. This issue affects TeamDavid through Rollout 524.

The search functionality in the TeamDavid Webbox application accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables unauthenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). If outbound connections to port 445 (SMB) are permitted, attackers can use this to conduct SMB relay or credential theft attacks. Exploitation of the “pathnameroot” parameter is possible without authentication.

Path traversal vulnerability in the archive creation functionality of TeamDavid Webbox. An attacker can manipulate the archive path to create folders in arbitrary locations, including sensitive directories like C:\Windows.

TeamDavid's Webbox does not enforce authentication or authorization checks when serving these log files. As a result, attackers can obtain sensitive error information or internal application details, potentially aiding in further attacks. This issue affects TeamDavid through Rollout 524.

Local file inclusion vulnerability in the send email, fax, SMS functionality of TeamDavid Webbox. By using the '@@attach' command in the 'scjob' field, files can be attached, and the filter restricting access to config and user folders can be bypassed via alternate data streams, allowing download of sensitive files like other users' access files with passwords or the server's private key.

TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing functionality (//ServerClient_celink.htm), which is appended to the redirect target in the 302 HTTP response. If a line feed is added, this will also be added to the redirect link, resulting in the ability to control the response headers. This issue affects TeamDavid through Rollout 524.

The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as "%2e" (representing a dot), an attacker can manipulate the portion of the URL following the top-level domain (TLD). If a similar, registerable TLD exists (for example, if ".com" is the application's domain, and ".company" is available for registration), an attacker can craft a URL to redirect users to a malicious ".company" domain. By using URL-encoded line feeds, it becomes possible to insert arbitrary response headers in the server's HTTP response. This issue affects TeamDavid through Rollout 524.

Arbitrary file deletion vulnerability in the send email, fax, SMS functionality of TeamDavid Webbox. By using the '@@COMMENTFILE' command in the 'scjob' field, any file on the system can be deleted.