Internal reference: MWB-1982 Type: CWE-400 (Uncontrolled Resource Consumption) Component: backend Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX App Suite backend 7.10.6-rev48, OX App Suite backend 8.11 First fixed revision: OX App Suite backend 7.10.6-rev49, OX App Suite backend 8.12 Discovery date: 2023-01-03 Solution date: 2023-07-24 Disclosure date: 2023-08-01 CVE: CVE-2023-29046 CVSS: 4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Details: Timeouts for external content do not cancel the connection. Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged. Risk: Some connections use user-controlled endpoints, which could be malicious and attempt to keep the connection open for an extended period of time. As a result users were able to trigger large amount of egress network connections, possibly exhausting network pool resources and lock up legitimate requests. No publicly available exploits are known. Solution: Please deploy the provided updates and patch releases. A new mechanism has been introduced to cancel external connections that might access user-controlled endpoints. --- Internal reference: MWB-1996 Type: CWE-287 (Improper Authentication) Component: backend Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX App Suite backend 7.10.6-rev48, OX App Suite backend 8.12 First fixed revision: OX App Suite backend 7.10.6-rev49, OX App Suite backend 8.13 Discovery date: 2023-01-09 Solution date: 2023-07-25 Disclosure date: 2023-08-01 Researcher credits: Tim Coen CVE: CVE-2023-26455 CVSS: 5.6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L) Details: RMI allows event organizer changes without authentication. RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Risk: Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. No publicly available exploits are known. Solution: Please deploy the provided updates and patch releases. The interface has been updated to require authenticated requests. --- Internal reference: GUARD-440 Type: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) Component: guard Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX App Suite guard 2.10.7-rev6 First fixed revision: OX App Suite guard 2.10.7-rev7 Discovery date: 2023-06-22 Solution date: 2023-07-06 Disclosure date: 2023-08-01 CVE: CVE-2023-26456 CVSS: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Details: XSS through unescaped OX Guard "productName" property. Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before processing it at the user interface, allowing for indirect cross-site scripting attacks. Risk: Accounts that were temporarily taken over could be configured to trigger persistent code execution, allowing an attacker to build a foothold. No publicly available exploits are known. Solution: Please deploy the provided updates and patch releases. Sanitization is in place for product names now. --- Internal reference: DOCS-4767 Type: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')) Component: office Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX App Suite office 7.10.6-rev5, OX App Suite office 8.12 First fixed revision: OX App Suite office 7.10.6-rev6, OX App Suite office 8.13 Discovery date: 2023-03-14 Solution date: 2023-04-27 Disclosure date: 2023-08-01 Researcher credits: Mehmet 'mdisec' Ince CVE: CVE-2023-29047 CVSS: 7.4 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Details: SQL Injection at Imageconverter "getMetadata". Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements. Risk: An attacker with access to the adjacent network and potentially API credentials, could read and modify database content which is accessible to the imageconverter SQL user account. No publicly available exploits are known. Solution: Please deploy the provided updates and patch releases. All possible IC WebService API request parameters are now validated before further processing. In case invalid parameters are detected, the incident gets logged on level ERROR and BAD_REQUEST (Http code 400) response is returned to caller. --- Internal reference: DOCS-4800 Type: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')) Component: office Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX App Suite office 7.10.6-rev5, OX App Suite office 8.12 First fixed revision: OX App Suite office 7.10.6-rev6, OX App Suite office 8.13 Discovery date: 2023-03-29 Solution date: 2023-04-27 Disclosure date: 2023-08-01 Researcher credits: Mehmet 'mdisec' Ince CVE: CVE-2023-26452 CVSS: 9.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Details: SQLi at Imageconverter cacheAndGetImageAndMetadata endpoint. Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Risk: Arbitrary SQL statements could be executed in the context of the services database user account. No publicly available exploits are known. Solution: Please deploy the provided updates and patch releases. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. --- Internal reference: DOCS-4801 Type: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')) Component: office Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX App Suite office 7.10.6-rev5, OX App Suite office 8.12 First fixed revision: OX App Suite office 7.10.6-rev6, OX App Suite office 8.13 Discovery date: 2023-03-29 Solution date: 2023-04-27 Disclosure date: 2023-08-01 Researcher credits: Mehmet 'mdisec' Ince CVE: CVE-2023-26453 CVSS: 9.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Details: SQLi at Imageconverter cacheImage endpoint. Requests to cache an image could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Risk: Arbitrary SQL statements could be executed in the context of the services database user account. No publicly available exploits are known. Solution: Please deploy the provided updates and patch releases. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. --- Internal reference: DOCS-4802 Type: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')) Component: office Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX App Suite office 7.10.6-rev5, OX App Suite office 8.12 First fixed revision: OX App Suite office 7.10.6-rev6, OX App Suite office 8.13 Discovery date: 2023-03-29 Solution date: 2023-04-27 Disclosure date: 2023-08-01 Researcher credits: Mehmet 'mdisec' Ince CVE: CVE-2023-26454 CVSS: 9.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Details: SQLi at Imageconverter getMetadata endpoint. Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Risk: Arbitrary SQL statements could be executed in the context of the services database user account. No publicly available exploits are known. Solution: Please deploy the provided updates and patch releases. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. --- Internal reference: DOCS-4926 Type: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) Component: office Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX App Suite office 7.10.6-rev7 First fixed revision: OX App Suite office 7.10.6-rev8 Discovery date: 2023-06-22 Solution date: 2023-07-07 Disclosure date: 2023-08-01 CVE: CVE-2023-29045 CVSS: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Details: XSS through unescaped "insertDrawing" content in collaboration mode. Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code. Risk: Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. No publicly available exploits are known. Solution: Please deploy the provided updates and patch releases. Operation data exchanged between collaborating parties does now gets checked for validity to avoid code execution. --- Internal reference: DOCS-4927 Type: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) Component: office Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX App Suite office 7.10.6-rev7 First fixed revision: OX App Suite office 7.10.6-rev8 Discovery date: 2023-06-22 Solution date: 2023-07-07 Disclosure date: 2023-08-01 CVE: CVE-2023-29044 CVSS: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Details: XSS through unescaped "imageData" content in collaboration mode. Documents operations could be manipulated to contain invalid data types, possibly script code. Risk: Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. No publicly available exploits are known. Solution: Please deploy the provided updates and patch releases. Operation data exchanged between collaborating parties does now get escaped to avoid code execution. --- Internal reference: DOCS-4928 Type: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) Component: office Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX App Suite office 7.10.6-rev7 First fixed revision: OX App Suite office 7.10.6-rev8 Discovery date: 2023-06-22 Solution date: 2023-06-23 Disclosure date: 2023-08-01 CVE: CVE-2023-29043 CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Details: XSS through unescaped "imageSrc" content at presentations. Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed when editing a document. Risk: Script code embedded in malicious documents could be executed in the context of the user editing the document when performing certain actions, like copying content. No publicly available exploits are known. Solution: Please deploy the provided updates and patch releases. The relevant attribute does now get encoded to avoid the possibility of executing script code.