CVE-2016-6842 in OX AppSuite
Summary
by MITRE
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Setting the user's name to JS code makes that code execute when selecting that user's "Templates" folder from OX Documents settings. This requires the folder to be shared to the victim. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/08/2019
This vulnerability exists in Open-Xchange OX App Suite versions prior to 7.8.2-rev8 and represents a critical cross-site scripting flaw that enables remote code execution within user contexts. The vulnerability stems from insufficient input validation and output encoding when processing user names that contain javascript code. When an attacker crafts a malicious user name containing executable javascript and shares the Templates folder with a victim, the malicious code executes whenever the victim interacts with that folder through the OX Documents settings interface. This represents a classic stored cross-site scripting vulnerability where the malicious payload is persistently stored within the application's user management system and executed during normal user operations. The vulnerability aligns with CWE-79, which describes cross-site scripting flaws that occur when untrusted data is embedded into web pages without proper validation or encoding.
The operational impact of this vulnerability extends beyond simple script execution to encompass full session hijacking capabilities and unauthorized administrative actions. When a victim accesses the compromised Templates folder, the malicious javascript code runs within their browser session, potentially stealing session cookies, credentials, or other sensitive information. Attackers can leverage this to impersonate legitimate users and perform actions such as sending emails, deleting data, modifying user permissions, or accessing restricted resources. The requirement for folder sharing creates a social engineering component where attackers must convince victims to accept shared folders, but once this is accomplished, the attack vector becomes fully automated and persistent. This vulnerability directly maps to attack techniques described in the MITRE ATT&CK framework under T1059.007 for command and scripting interpreter and T1566 for credential harvesting through social engineering.
The technical exploitation requires minimal privileges and leverages the application's legitimate folder sharing functionality to deliver malicious payloads. Attackers need only register a user account with javascript code embedded in the name field and then share the Templates folder with target users. The vulnerability affects the web interface specifically, making it accessible through standard browser-based attacks without requiring direct system access. Users with administrative privileges are particularly at risk as they can potentially escalate privileges through this vector. The security implications extend to data integrity and confidentiality, as the malicious code can modify or exfiltrate sensitive user data. Organizations should implement immediate mitigations including upgrading to version 7.8.2-rev8 or later, implementing proper input validation on user name fields, and monitoring for suspicious folder sharing activities. Additionally, network-level controls such as web application firewalls and content filtering systems can provide additional defense-in-depth measures to detect and prevent exploitation attempts.