CVE-2025-63406
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on GroupOffice installations via improper input validation in the dbToApi() function and eval() usage in FunctionField.php. It affects all GroupOffice versions before v25.0.47 and v6.8.136. Attackers can exploit this to gain full control of affected systems.
💻 Affected Systems
- Intermesh BV GroupOffice
📦 What is this software?
Group Office by Group Office
Group Office by Group Office
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining root/admin privileges, data exfiltration, ransomware deployment, and persistent backdoor installation.
Likely Case
Remote code execution leading to web shell installation, credential theft, and lateral movement within the network.
If Mitigated
Limited impact with proper network segmentation, WAF rules blocking malicious payloads, and restricted file permissions.
🎯 Exploit Status
Public PoC available on GitHub demonstrates exploitation. Attack requires network access to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v25.0.47 or v6.8.136
Vendor Advisory: https://www.group-office.com/
Restart Required: Yes
Instructions:
1. Backup your GroupOffice installation and database. 2. Download latest version from official GroupOffice website. 3. Follow upgrade instructions for your version path. 4. Restart web server services. 5. Verify successful upgrade.
🔧 Temporary Workarounds
WAF Rule Implementation
allBlock malicious eval() and dbToApi() payloads at network perimeter
File Permission Restriction
linuxRestrict write permissions to FunctionField.php and related directories
chmod 644 /path/to/GroupOffice/modules/addressbook/model/FunctionField.php
chown root:www-data /path/to/GroupOffice/modules/addressbook/model/
🧯 If You Can't Patch
- Isolate vulnerable systems in separate network segment with strict firewall rules
- Implement application-level input validation and sanitization for all user inputs
🔍 How to Verify
Check if Vulnerable:
Check GroupOffice version in admin panel or via version.php fileCheck Version:
grep -r '\$version' /path/to/groupoffice/version.php 2>/dev/null || cat /path/to/groupoffice/version.phpVerify Fix Applied:
Confirm version is v25.0.47 or higher (for v25 branch) or v6.8.136 or higher (for v6 branch)📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to addressbook endpoints
- eval() function calls in web server logs
- Suspicious file creation in web directories
Network Indicators:
- HTTP requests containing malicious PHP code patterns
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND (uri="*addressbook*" AND (method="POST" AND (body="*eval(*" OR body="*dbToApi*")))