Groupoffice Local File Inclusion Scanner
Targets the 'file' parameter in GroupOffice's download functionality, allowing attackers to read arbitrary server files via path traversal.
Short Info
Level
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
11 days 15 hours
Scan only one
URL
Toolbox
GroupOffice is a collaborative office suite designed for small to medium enterprises, offering modules for email, project management, calendars, contacts, and file sharing. It enables teams to work together seamlessly from any web browser, supporting remote collaboration and integration with existing systems. Its modular architecture allows businesses to customize the platform to their specific needs, making it a versatile tool for daily operations.
Local File Inclusion (LFI) is a vulnerability that arises when an application includes files based on user-supplied input without proper sanitization. In GroupOffice, this occurs when the application fails to validate file paths, allowing attackers to traverse directories and include files from the server's filesystem. This can lead to exposure of sensitive data such as configuration files, passwords, or source code.
The vulnerability is specifically present in the 'download' endpoint, where the 'file' parameter is used to specify the file path. An attacker can manipulate this parameter with sequences like '../' to navigate to restricted directories. For example, requesting '../../etc/passwd' could retrieve the system's password file, demonstrating the lack of input validation.
If exploited, an attacker can read arbitrary files on the server, potentially gaining access to database credentials, application secrets, or user data. This could lead to further attacks such as privilege escalation or remote code execution if combined with other vulnerabilities. The impact is severe, as it compromises the confidentiality and integrity of the entire GroupOffice installation.