CVE-2016-6843 in OX AppSuite
Summary
by MITRE
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Script code can be injected to contact names. When adding those contacts to a group, the script code gets executed in the context of the user which creates or changes the group by using autocomplete. In most cases this is a user with elevated permissions. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/08/2019
The vulnerability CVE-2016-6843 represents a critical cross-site scripting flaw within Open-Xchange OX App Suite versions prior to 7.8.2-rev8, classified under CWE-79 - Improper Neutralization of Input During Web Page Generation. This security weakness stems from inadequate sanitization of contact names during the group membership management process, creating a persistent threat vector that allows attackers to inject malicious script code into contact fields. The vulnerability specifically manifests when users add contacts to groups through the autocomplete functionality, which then executes the injected code within the context of the authenticated user's session.
The technical exploitation of this vulnerability occurs through a multi-stage attack process that begins with the injection of malicious script code into contact name fields. When these compromised contacts are subsequently added to groups, the script code executes automatically during the group creation or modification process. The execution context is particularly dangerous because it typically involves users with elevated privileges, such as administrators or power users who have extensive access rights within the system. This privilege escalation potential significantly amplifies the impact of the vulnerability, as attackers can leverage the elevated permissions to perform actions that would otherwise be restricted.
The operational impact of this vulnerability extends beyond simple code execution, creating a comprehensive attack surface that can result in session hijacking and unauthorized administrative actions. Attackers can craft malicious scripts that manipulate the web interface to send emails on behalf of users, delete critical data, modify user permissions, or establish persistent backdoors within the system. The vulnerability's design flaw allows for code execution in the user's browser context, which means that any actions performed through the web interface can be manipulated by the injected script. This creates a persistent threat that can affect multiple users within the organization, especially when the compromised contacts are added to groups with broad membership or administrative privileges.
The attack vector for this vulnerability aligns with ATT&CK technique T1059.007 - Command and Scripting Interpreter: JavaScript, as it leverages JavaScript execution within the web application's context. The vulnerability demonstrates poor input validation and sanitization practices that violate secure coding principles, particularly those related to web application security and user input handling. Organizations using affected versions of Open-Xchange OX App Suite face significant risk of unauthorized access and data compromise, as the vulnerability can be exploited through simple contact management operations. The remediation approach requires immediate patching to version 7.8.2-rev8 or later, along with comprehensive input validation and sanitization measures to prevent similar vulnerabilities in other applications. Security teams should also implement monitoring for anomalous group membership changes and user behavior that might indicate exploitation attempts, as the vulnerability's impact can be difficult to detect through conventional security scanning methods.