Group-Office SQL Injection Vulnerability in JMAP Contact Query Endpoint Allowing Account Takeover

A SQL injection vulnerability has been identified in Group-Office versions prior to 6.8.158, 25.0.92, and 26.0.17. This vulnerability exists in the JMAP 'Contact/query' endpoint, specifically within the 'addressBookIds' filter. It allows authenticated users with basic address book access to inject malicious SQL, extracting arbitrary data from the database. This includes active session tokens of other users, enabling full account takeover, even of the System Administrator, without requiring their password.

Impact

Exploitation of this vulnerability allows for SQL injection, leading to unauthorized data access and full account takeover of any user, including administrators.

Remediation

Users can upgrade to Group-Office versions 6.8.158, 25.0.92, or 26.0.17 to address this vulnerability.