May 2022 Summaries

The Horde webmail application has a vulnerability that allows an attacker to fully take over an instance as soon as a victim opens an email the attacker sent, without requiring further interaction from the user. The vulnerability exists in the default configuration and can be exploited with no knowledge of a targeted Horde instance. An authenticated user can execute arbitrary code on the underlying server by sending a maliciously crafted email that triggers the vulnerability via Cross-Site-Request-Forgery (CSRF). This allows an attacker to intercept every sent and received email, access password-reset links, and steal all credentials of users logging into the webmail service. The vendor has not released a patch at the time of writing, making it crucial for organizations using Horde webmail to consider alternative solutions.

Icinga Web 2, a modern open-source IT monitoring system, has been found to contain two vulnerabilities that allow attackers to compromise the server by exploiting path traversal and remote code execution. The first vulnerability (CVE-2022-24716) enables the disclosure of any file on the server without authentication or prior knowledge of a user account, while the second vulnerability (CVE-2022-24715) allows for the execution of arbitrary PHP code from the administration interface. Both vulnerabilities can be chained to compromise the server if an attacker reaches the database by first disclosing configuration files and modifying the administrator's password. Icinga Web 2 has released patches for these vulnerabilities, including versions 2.8.6, 2.9.6, and 2.10, and recommends that users only expose their systems to trusted IP addresses or put them behind a centralized authentication system.

SonarLint has been released for VS Code, allowing developers to write clean C and C++ code in the popular IDE. The tool automatically analyzes code as it is written and provides relevant information and fixes for issues detected. Users can configure analysis using compilation databases and access rule descriptions directly from the issue. SonarLint also offers quick fixes for specific rules and situations, enabling developers to learn while coding. Additional features include rule enabling and disabling, connected mode with SonarQube and SonarCloud, and availability in other IDEs such as CLion, Eclipse, and Visual Studio.