SOGo SQL Injection Vulnerability in Access Control List Management

A SQL injection vulnerability has been identified in SOGo version 5.12.7, specifically within the Access Control List (ACL) management feature. This vulnerability allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Exploitation of this vulnerability enables attackers to inject malicious SQL code that can write extracted data into the sogo_acl table, which can then be retrieved through the /acls API, creating an out-of-band data exfiltration channel.

Impact

Exploitation of this vulnerability allows for arbitrary data extraction from the database, with the injected SQL subqueries executed in the context of the database user, potentially leading to unauthorized data access or manipulation.

Remediation

Users are advised to update to SOGo version 5.12.8, which addresses this vulnerability.