CVE-2019-12095

An attacker sends a crafted email or link to the victim; when the victim visits the attacker's `index.html` page while authenticated to the Horde webmail server, a cross-site request forgery (CSRF) is performed. The page issues an XMLHttpRequest POST to `/trean/` with `actionID=add_bookmark` and a `treanBookmarkTags` parameter containing a stored XSS payload that loads `stealer.js` from the attacker's server [ref_id=1]. The injected script then iterates through the victim's inbox messages and exfiltrates them to the attacker's `stealer.php` endpoint [ref_id=1].

The vulnerability resides in the Trean Bookmarks module (default in Horde Groupware). The CSRF attack targets the `add_bookmark` action via a POST to the `/trean/` URI, where the `treanBookmarkTags` parameter is attacker-controlled [ref_id=1]. No patch is included in the bundle.

The bundle does not contain a patch or official remediation. The advisory [ref_id=1] describes the vulnerability chain but does not provide a fix commit or vendor advisory. To close the issue, the application should implement anti-CSRF tokens on the bookmark creation form and properly encode or sanitize the `treanBookmarkTags` parameter before rendering to prevent stored XSS.

1. Host `index.html` (containing the CSRF + XSS payload), `stealer.js`, and `stealer.php` on an attacker-controlled server. 2. Send the victim a link to `index.html`. 3. When the victim (authenticated to the Horde webmail) visits the page, a CSRF POST to `/trean/` creates a bookmark with a stored XSS payload in `treanBookmarkTags`. 4. The XSS loads `stealer.js`, which fetches inbox messages via `imp/view.php?actionID=view_source` and POSTs them to `stealer.php` [ref_id=1].