Secunia

Paul Craig has discovered a vulnerability in Horde, which can be exploited by malicious people to disclose sensitive information.

Input passed to the "url" parameter in "services/go.php" isn't properly verified, before it is used in a "readfile()" call. This can be exploited to disclose the content of arbitrary files via e.g. the "php://" protocol wrapper.

Example:
http://[victim]/services/go.php?url=php://filter/resource=file:///[file]&untrusted=1

NOTE: This was inadequately fixed in version 3.1 as it is possible to use the "http://', 'https://', and "'ftp://' URI handlers to request content from another site. This can e.g. be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site by requesting content from a malicious web site.

The vulnerability has been confirmed in version 3.0.9 and has also been reported in prior versions.

Solution
Update to version 3.0.11 or 3.1.2:
Further details available in Customer Area

Provided and/or discovered by
Paul Craig, Security-Assessment.com

Additional information provided by Moritz Naumann.

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area