App Suite Security Advisories

OXAS-ADV-2023-0003

Metadata

  • Document type: OX App Suite Security Advisory
  • Publisher: Open-Xchange GmbH
  • Publication Date: 2023-05-02
  • Current version: 3
  • Version status: Final
  • Aggregate severity: Critical

References

Vulnerabilities

CVE-2023-26445: Themes can be abused to inject script code for persistent XSS

  • CVE reference: CVE-2023-26445open in new window
  • Internal reference: OXUIB-2282
  • CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
  • Discovery date: 2023-03-20

Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login.

Product status

Last affected
ProductsCVSS-VectorCVSS Base Score
OX App Suite frontend 7.10.6-rev27CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:L5.4

Threats

Impact

Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account.

Exploit status

No publicly available exploits are known.

Remediation

Vendor fix (2023-04-20)
For products
  • OX App Suite frontend 7.10.6-rev28

Please deploy the provided updates and patch releases. We now sanitize the theme value and use a default fallback if no theme matches.

CVE-2023-26446: XSS using application passwords "lastDevice" property

  • CVE reference: CVE-2023-26446open in new window
  • Internal reference: OXUIB-2283
  • CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
  • Discovery date: 2023-03-20

The users clientID at "application passwords" was not sanitized or escaped before being added to DOM.

Product status

Last affected
ProductsCVSS-VectorCVSS Base Score
OX App Suite frontend 7.10.6-rev27CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N5.4
OX App Suite frontend 8.11CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N5.4

Threats

Impact

Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account.

Exploit status

No publicly available exploits are known.

Remediation

Vendor fix (2023-04-20)
For products
  • OX App Suite frontend 7.10.6-rev28
  • OX App Suite frontend 8.12

Please deploy the provided updates and patch releases. We now sanitize the user-controllable clientID parameter.

CVE-2023-26447: XSS in upsell portal widget

  • CVE reference: CVE-2023-26447open in new window
  • Internal reference: OXUIB-2284
  • CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
  • Discovery date: 2023-03-20

The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not get escaped before being added to DOM.

Product status

Last affected
ProductsCVSS-VectorCVSS Base Score
OX App Suite frontend 7.10.6-rev27CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N5.4
OX App Suite frontend 7.6.3-rev52CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N5.4

Threats

Impact

Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account.

Exploit status

No publicly available exploits are known.

Remediation

Vendor fix (2023-04-20)
For products
  • OX App Suite frontend 7.10.6-rev28
  • OX App Suite frontend 7.6.3-rev53

Please deploy the provided updates and patch releases. We now sanitize jslob content.

CVE-2023-26448: XSS via user-defined login/logout URL

  • CVE reference: CVE-2023-26448open in new window
  • Internal reference: OXUIB-2285
  • CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
  • Discovery date: 2023-03-20

Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers.

Product status

Last affected
ProductsCVSS-VectorCVSS Base Score
OX App Suite frontend 7.10.6-rev29CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N5.4
OX App Suite frontend 7.6.3-rev52CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N5.4

Threats

Impact

Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account.

Exploit status

No publicly available exploits are known.

Remediation

Vendor fix (2023-06-01)
For products
  • OX App Suite frontend 7.10.6-rev30
  • OX App Suite frontend 7.6.3-rev53

Please deploy the provided updates and patch releases. We now sanitize jslob content for those locations to avoid redirects to malicious content.

CVE-2023-26449: XSS by returning user-defined content-type as Chat service resource

  • CVE reference: CVE-2023-26449open in new window
  • Internal reference: OXUIB-2286
  • CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
  • Discovery date: 2023-03-20

The "OX Chat" web service did not specify a media-type when processing responses by external resources.

Product status

Last affected
ProductsCVSS-VectorCVSS Base Score
OX App Suite frontend 7.10.6-rev27CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N5.4

Threats

Impact

Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account.

Exploit status

No publicly available exploits are known.

Remediation

Vendor fix (2023-04-19)
For products
  • OX App Suite frontend 7.10.6-rev28

Please deploy the provided updates and patch releases. We are now defining the accepted media-type to avoid code execution.

CVE-2023-26450: XSS using malicious Count service resource

  • CVE reference: CVE-2023-26450open in new window
  • Internal reference: OXUIB-2287
  • CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
  • Discovery date: 2023-03-20

The "OX Count" web service did not specify a media-type when processing responses by external resources.

Product status

Last affected
ProductsCVSS-VectorCVSS Base Score
OX App Suite frontend 7.10.6-rev27CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N5.4

Threats

Impact

Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account.

Exploit status

No publicly available exploits are known.

Remediation

Vendor fix (2023-04-19)
For products
  • OX App Suite frontend 7.10.6-rev28

Please deploy the provided updates and patch releases. We are now defining the accepted media-type to avoid code execution.

CVE-2023-26438: SSRF using DNS rebinding attacks

External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache. Attackers that were timing DNS cache expiry correctly were able to inject configuration that would bypass existing network deny-lists.

Product status

Last affected
ProductsCVSS-VectorCVSS Base Score
OX App Suite backend 7.10.6-rev42CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N4.3
OX App Suite backend 8.10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N4.3

Threats

Impact

Attackers could exploit this weakness to discover the existence of restricted network infrastructure and service availability.

Exploit status

No publicly available exploits are known.

Remediation

Vendor fix (2023-04-27)
For products
  • OX App Suite backend 7.10.6-rev43
  • OX App Suite backend 8.11

Please deploy the provided updates and patch releases. Improvements were made to include deny-lists not only during the check of the provided connection data, but also during use.

CVE-2023-26430: Mailfilter (SIEVE) rules accept control characters

  • CVE reference: CVE-2023-26430open in new window
  • Internal reference: MWB-2020
  • CWE: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
  • Discovery date: 2023-01-23

Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules.

Product status

Last affected
ProductsCVSS-VectorCVSS Base Score
OX App Suite backend 7.10.6-rev42CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N3.5
OX App Suite backend 8.10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N3.5

Threats

Impact

This could be abused to access SIEVE extension that are not allowed by App Suite or to inject rules which would break per-user filter processing, requiring manual cleanup of such rules.

Exploit status

No publicly available exploits are known.

Remediation

Vendor fix (2023-04-26)
For products
  • OX App Suite backend 7.10.6-rev43
  • OX App Suite backend 8.11

Please deploy the provided updates and patch releases. We have added sanitization to all mail-filter APIs to avoid forwardning control characters to subsystems.

CVE-2023-26443: Potentially malicious SQL injection when using full-text autocomplete

  • CVE reference: CVE-2023-26443open in new window
  • Internal reference: MWB-2086
  • CWE: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
  • Discovery date: 2023-03-14

Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements.

Product status

Last affected
ProductsCVSS-VectorCVSS Base Score
OX App Suite backend 7.10.6-rev42CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L5.5
OX App Suite backend 8.11CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L5.5

Threats

Impact

With existing sanitization in place, this can be abused to trigger benign SQL Exceptions but could potentially be escalated to a malicious SQL injection vulnerability.

Exploit status

No publicly available exploits are known.

Remediation

Vendor fix (2023-04-27)
For products
  • OX App Suite backend 7.10.6-rev43
  • OX App Suite backend 8.12

Please deploy the provided updates and patch releases. We now properly encode single quotes for SQL FULLTEXT queries.

CVE-2023-26451: oAuth provider uses predictable secret source, allows to take over any oAuth session

Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service.

Product status

Last affected
ProductsCVSS-VectorCVSS Base Score
OX App Suite backend 8.11CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N7.5

Threats

Impact

Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts could be compromised. The oAuth Authorization Service is not enabled by default.

Exploit status

No publicly available exploits are known.

Remediation

Vendor fix (2023-04-28)
For products
  • OX App Suite backend 8.12

Please deploy the provided updates and patch releases. We have updated the implementation to use sources with sufficient randomness to generate authorization tokens.

CVE-2023-26439: SQL Injection at Cacheservice "getObjects" API

  • CVE reference: CVE-2023-26439open in new window
  • Internal reference: DOCS-4726
  • CWE: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
  • Discovery date: 2023-02-13

The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement.

Product status

Last affected
ProductsCVSS-VectorCVSS Base Score
OX App Suite office 8.10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H9.6

Threats

Impact

Attackers with access to a local or restricted network were able to perform arbitrary SQL queries, discovering other users cached data.

Exploit status

No publicly available exploits are known.

Remediation

Vendor fix (2023-03-14)
For products
  • OX App Suite office 8.11

Please deploy the provided updates and patch releases. We have improved the input check for API calls and filter for potentially malicious content.

CVE-2023-26440: SQL Injection at Cacheservice "registerGroup" API

  • CVE reference: CVE-2023-26440open in new window
  • Internal reference: DOCS-4727
  • CWE: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
  • Discovery date: 2023-02-13

The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creating new cache groups.

Product status

Last affected
ProductsCVSS-VectorCVSS Base Score
OX App Suite office 8.10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H8.3

Threats

Impact

Attackers with access to a local or restricted network could perform arbitrary SQL queries.

Exploit status

No publicly available exploits are known.

Remediation

Vendor fix ()
For products
  • OX App Suite office 8.11

Please deploy the provided updates and patch releases. We have improved the input check for API calls and filter for potentially malicious content.

CVE-2023-26441: Cacheservices allows local file inclusion/removal through directory traversal

  • CVE reference: CVE-2023-26441open in new window
  • Internal reference: DOCS-4728
  • CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
  • Discovery date: 2023-02-14

Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources.

Product status

Last affected
ProductsCVSS-VectorCVSS Base Score
OX App Suite office 8.10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L6.9

Threats

Impact

An attacker with access to the database and a local or restricted network would be able to read arbitrary local file system resources that are accessible by the services system user account.

Exploit status

No publicly available exploits are known.

Remediation

Vendor fix (2023-04-28)
For products
  • OX App Suite office 8.11

Please deploy the provided updates and patch releases. We have improved path validation and make sure that any access is contained to the defined root directory.

CVE-2023-26442: Cacheservice HTTP client follow redirect responses, allowing SSRF

In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend.

Product status

Last affected
ProductsCVSS-VectorCVSS Base Score
OX App Suite office 8.10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N3.2

Threats

Impact

An attacker with access to a local or restricted network with the capability to intercept and replay HTTP requests to sproxyd (or who is in control of the sproxyd service) could perform a server-side request-forgery attack and make Cacheservice connect to unexpected resources.

Exploit status

No publicly available exploits are known.

Remediation

Vendor fix ()
For products
  • OX App Suite office 8.11

Please deploy the provided updates and patch releases. We have disabled the ability to follow HTTP redirects when connecting to sproxyd resources.