# OXAS-ADV-2023-0005

## Metadata

* Document type: OX App Suite Security Advisory
* Publisher: Open-Xchange GmbH
* Publication Date: 2023-09-19
* Current version: 4
* Version status: Final
* Aggregate severity: High

## References

* [CSAF document](https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0005.json)
* [Release Notes (.pdf)](https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6248_7.10.6_2023-09-19.pdf)
* [Advisory (.md)](https://documentation.open-xchange.com/appsuite/security/advisories/md/2023/oxas-adv-2023-0005.md)
* [Advisory (.html)](https://documentation.open-xchange.com/appsuite/security/advisories/html/2023/oxas-adv-2023-0005.html)
* [Advisory (.txt)](https://documentation.open-xchange.com/appsuite/security/advisories/txt/2023/oxas-adv-2023-0005.txt)

## Vulnerabilities

### CVE-2023-29048: OXMF templates allow remote code execution

* CVE reference: [CVE-2023-29048](https://www.cve.org/CVERecord?id=CVE-2023-29048)
* Internal reference: MWB-2261
* CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
* Discovery date: 2023-08-08

A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user.

#### Product status

##### Last affected

| Products | CVSS-Vector | CVSS Base Score |
|-|-|-|
| OX App Suite backend 7.10.6-rev50 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | 8.8 |

#### Threats

##### Impact

Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially violate integrity by modifying resources.

##### Exploit status

No publicly available exploits are known.

#### Remediation

##### Vendor fix (2023-09-14)

###### For products

* OX App Suite backend 7.10.6-rev51

Please deploy the provided updates and patch releases. The template engine has been reconfigured to deny execution of harmful commands on a system level.

### CVE-2023-29050: LDAP filter injection vulnerability in Contacts Provider LDAP

* CVE reference: [CVE-2023-29050](https://www.cve.org/CVERecord?id=CVE-2023-29050)
* Internal reference: MWB-2274
* CWE: CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'))
* Discovery date: 2023-08-17

The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy.

#### Product status

##### Last affected

| Products | CVSS-Vector | CVSS Base Score |
|-|-|-|
| OX App Suite backend 7.10.6-rev50 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L | 7.6 |
| OX App Suite backend 8.16 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L | 7.6 |

#### Threats

##### Impact

Unauthorized users could break confidentiality of information in the directory and potentially cause high load on the directory server, leading to denial of service.

##### Exploit status

No publicly available exploits are known.

#### Remediation

##### Vendor fix (2023-09-18)

###### For products

* OX App Suite backend 7.10.6-rev51
* OX App Suite backend 8.17

Please deploy the provided updates and patch releases. Encoding has been added for user-provided fragments that are used when constructing the LDAP query.

### CVE-2023-29049: XSS in upsell portal widget

* CVE reference: [CVE-2023-29049](https://www.cve.org/CVERecord?id=CVE-2023-29049)
* Internal reference: OXUIB-2489
* CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
* Discovery date: 2023-08-14

The "upsell" widget at the portal page could be abused to inject arbitrary script code.

#### Product status

##### Last affected

| Products | CVSS-Vector | CVSS Base Score |
|-|-|-|
| OX App Suite frontend 7.10.6-rev33 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | 5.4 |

#### Threats

##### Impact

Attackers that manage to lure users to a compromised account, or gain temporary access to a legitimate account, could inject script code to gain persistent code execution capabilities under a trusted domain.

##### Exploit status

No publicly available exploits are known.

#### Remediation

##### Vendor fix (2023-09-18)

###### For products

* OX App Suite frontend 7.10.6-rev34

Please deploy the provided updates and patch releases. User input for this widget is now sanitized to avoid malicious content the be processed.