Horde Groupware User Enumeration Vulnerability

A user enumeration vulnerability has been identified in Horde Groupware version 5.2.22, allowing an unauthenticated attacker to verify the existence of user accounts. The vulnerability arises in the 'imp/attachment.php' file, where an HTTP request can be sent with the 'id' and 'u' parameters. If the specified user exists, the server responds by downloading an empty file. Conversely, if the user does not exist, no download occurs, thereby revealing the user's validity status.

Impact

Exploitation of this vulnerability allows for user enumeration, enabling attackers to identify valid accounts on the system.

Reproduction

To reproduce this vulnerability, send an HTTP request to '/imp/attachment.php' with the 'id' and 'u' parameters. If the user exists, an empty file will be downloaded. If the user does not exist, no download will occur.