OXAS-ADV-2024-0002
Metadata
- Document type: OX App Suite Security Advisory
- Publisher: Open-Xchange GmbH
- Publication Date: 2024-03-06
- Current version: 2
- Version status: Final
- Aggregate severity: Medium
References
Vulnerabilities
CVE-2024-23187: XSS by abusing CID replacement
- CVE reference: CVE-2024-23187
- Internal reference: MWB-2471
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
- Discovery date: 2024-01-29
Description
Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option.
Product status
Last affected
| Products | CVSS-Vector | CVSS Base Score |
|---|---|---|
| OX App Suite backend 8.21 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | 6.5 |
Threats
Impact
Attackers could perform malicious API requests or extract information from the users account. Exploiting the vulnerability requires user interaction.
Exploit status
No publicly available exploits are known.
Remediation
Vendor fix (2024-03-04)
For products
- OX App Suite backend 8.22
Please deploy the provided updates and patch releases. CID replacement has been hardened to omit invalid identifiers.
CVE-2024-23186: XSS with mail displayname in mobile view
- CVE reference: CVE-2024-23186
- Internal reference: OXUIB-2735
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
- Discovery date: 2024-02-13
Description
E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices.
Product status
Last affected
| Products | CVSS-Vector | CVSS Base Score |
|---|---|---|
| OX App Suite frontend 8.21 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | 6.5 |
Threats
Impact
Attackers could perform malicious API requests or extract information from the users account.
Exploit status
No publicly available exploits are known.
Remediation
Vendor fix (2024-03-04)
For products
- OX App Suite frontend 8.22
Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding displayname information to the web interface.
CVE-2024-23188: XSS using mail attachment file names
- CVE reference: CVE-2024-23188
- Internal reference: OXUIB-2695
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
- Discovery date: 2024-01-10
Description
Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session. Common user interaction is required for the vulnerability to trigger.
Product status
Last affected
| Products | CVSS-Vector | CVSS Base Score |
|---|---|---|
| OX App Suite frontend 8.21 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | 6.5 |
Threats
Impact
Attackers could perform malicious API requests or extract information from the users account.
Exploit status
No publicly available exploits are known.
Remediation
Vendor fix (2024-03-04)
For products
- OX App Suite frontend 8.22
Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding attachment information to the web interface.
CVE-2024-23193: Documentconverter allows access to other user exported PDF files
- CVE reference: CVE-2024-23193
- Internal reference: DOCS-5199
- CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
- Discovery date: 2024-01-10
Description
E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account.
Product status
Last affected
| Products | CVSS-Vector | CVSS Base Score |
|---|---|---|
| OX App Suite office 8.21 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N | 5.3 |
Threats
Impact
Users of the same service node could access other users E-Mails in case they were exported as PDF for a brief moment until caches were cleared. Successful exploitation requires good timing and modification of multiple request parameters.
Exploit status
No publicly available exploits are known.
Remediation
Vendor fix (2024-02-09)
For products
- OX App Suite office 8.22
Please deploy the provided updates and patch releases. The cache for PDF exports now takes user session information into consideration when performing authorization decisions.