OXAS-ADV-2022-0002: OX App Suite Security Advisory

References

• Release Notes
• Release Notes
• CSAF document

Vulnerabilities

Non-alphanumeric content can be injected by the user as JS content for the "upsell" module. As a result, the code will be executed during subsequent logins and opening the "Portal" application, enabling a persistent cross-site scripting attack vector.

Product status

Last affected

Remediations

Vendor fix (2022-10-21)

We improved the allow-list sanitizing algorithm to deal with non-alphanumeric code.

For products:

• OX App Suite backend 7.10.5-rev51
• OX App Suite backend 7.10.6-rev30

Threats

Exploit status

No publicly available exploits are known.

Impact

Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface (e.g. redirecting to a third-party site). To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account.

HTML content can be injected by the user as JS content for the "upsell ads" module. As a result, the code will be executed during subsequent logins and opening the "Portal" application, enabling a persistent cross-site scripting attack vector.

Product status

Last affected

Remediations

Vendor fix (2022-10-21)

We improved the sanitization process for upsell ads.

For products:

• OX App Suite frontend 7.10.5-rev39
• OX App Suite frontend 7.10.6-rev20

Threats

Exploit status

No publicly available exploits are known.

Impact

Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface (e.g. redirecting to a third-party site). To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account.

In case activity tracking adapters are enabled but not defined, users can use jslob to define own tracking settings for an account. This allows adding arbitrary values to trigger a specific URL or load a library.

Product status

Last affected

Remediations

Vendor fix (2022-10-25)

We made the related jslob configuration endpoint read-only for users.

For products:

• OX App Suite backend 7.10.5-rev51
• OX App Suite backend 7.10.6-rev30

Threats

Exploit status

No publicly available exploits are known.

Impact

Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface (e.g. redirecting to a third-party site). To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account.

When changing a valid external POP3 mail account as a user, the operation to update the accounts settings did not consider deny-list values.

Product status

Last affected

Remediations

Vendor fix (2022-10-24)

We now check compliance with existing deny-list content when updating POP3 mail accounts.

For products:

• OX App Suite backend 7.10.5-rev51
• OX App Suite backend 7.10.6-rev30

Threats

Exploit status

No publicly available exploits are known.

Impact

Server-initiated requests can be directed to internal resources that are restricted based on deny-list settings. This can be used to determine "internal" addresses and services, depending on measurement and content of error responses. While no data of such services can be exfiltrated, the risk is a violation of perimeter based security policies.

The external E-Mail autodiscovery feature performs connections checks based on the E-Mail addresses host-part. Those do not take existing deny-lists into respect, allowing attackers with access to DNS records of a domain to redirect requests to illegal addresses.

Product status

Last affected

Remediations

Vendor fix (2022-11-07)

We check for compliance with existing deny-list content when performing mail account autodiscovery.

For products:

• OX App Suite backend 7.10.5-rev51
• OX App Suite backend 7.10.6-rev30

Threats

Exploit status

No publicly available exploits are known.

Impact

Server-initiated requests can be directed to internal resources that are restricted based on deny-list settings. This can be used to determine "internal" addresses and services, depending on measurement and content of error responses. While no data of such services can be exfiltrated, the risk is a violation of perimeter based security policies.

A critical vulnerability at the Apache Commons Text library has been identified, which is used by OX App Suite and OX Documents. However, our products do not directly use the vulnerable StringSubstitutor class. Based on current knowledge that means our products are not vulnerable.

Product status

Last affected

Remediations

Vendor fix (2022-10-21)

We provided a update for this library to resolve the risk as a precaution, in case custom implementations use the vulnerable class.

For products:

• OX App Suite backend 7.10.5-rev51
• OX App Suite backend 7.10.6-rev30
• OX App Suite office 7.10.5-rev11
• OX App Suite office 7.10.6-rev6

Threats

Exploit status

No publicly available exploits are known.

Impact

Remote Code Execution, see CVE-2022-42889.