Groupoffice Local File Inclusion Scanner

GroupOffice is a collaborative office suite designed for small to medium enterprises, offering modules for email, project management, calendars, contacts, and file sharing. It enables teams to work together seamlessly from any web browser, supporting remote collaboration and integration with existing systems. Its modular architecture allows businesses to customize the platform to their specific needs, making it a versatile tool for daily operations.

Local File Inclusion (LFI) is a vulnerability that arises when an application includes files based on user-supplied input without proper sanitization. In GroupOffice, this occurs when the application fails to validate file paths, allowing attackers to traverse directories and include files from the server's filesystem. This can lead to exposure of sensitive data such as configuration files, passwords, or source code.

The vulnerability is specifically present in the 'download' endpoint, where the 'file' parameter is used to specify the file path. An attacker can manipulate this parameter with sequences like '../' to navigate to restricted directories. For example, requesting '../../etc/passwd' could retrieve the system's password file, demonstrating the lack of input validation.

If exploited, an attacker can read arbitrary files on the server, potentially gaining access to database credentials, application secrets, or user data. This could lead to further attacks such as privilege escalation or remote code execution if combined with other vulnerabilities. The impact is severe, as it compromises the confidentiality and integrity of the entire GroupOffice installation.