CVE-2016-6844 in OX AppSuite
Summary
by MITRE
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Script code within SVG files is maintained when opening such files "in browser" based on our Mail or Drive app. In case of "a" tags, this may include link targets with base64 encoded "data" references. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/08/2019
The vulnerability CVE-2016-6844 represents a critical cross-site scripting flaw in Open-Xchange OX App Suite versions prior to 7.8.2-rev8, specifically affecting the handling of SVG files within the Mail and Drive applications. This issue stems from insufficient input validation and sanitization of embedded script code within Scalable Vector Graphics files, creating a persistent security risk for end users who interact with potentially malicious attachments or shared documents. The vulnerability manifests when users open SVG files directly in their browser through the web interface, bypassing normal security mechanisms that would typically prevent execution of embedded scripts. The flaw is particularly dangerous because it leverages the inherent capabilities of SVG files to contain executable script code, which can be interpreted and executed by modern web browsers without proper security boundaries.
The technical exploitation of this vulnerability occurs through the improper handling of "a" tags within SVG files, which can contain base64 encoded data references that serve as link targets. When these malicious SVG files are opened through the Mail or Drive applications, the browser renders the embedded script code as part of the page content, effectively executing the malicious payload within the user's authenticated session context. This creates a sophisticated attack vector where threat actors can craft SVG files containing malicious JavaScript that executes with the privileges and permissions of the logged-in user. The vulnerability falls under CWE-79 Improper Neutralization of Input During Web Page Generation, specifically manifesting as a cross-site scripting attack that operates within the same security context as the victim's browser session. The ATT&CK framework categorizes this as a technique involving web-based exploitation through malicious file attachments, leveraging the trust relationship between the user and the application to execute unauthorized actions.
The operational impact of CVE-2016-6844 extends beyond simple script execution, as it enables session hijacking and unauthorized manipulation of user data through the web interface. Attackers can leverage this vulnerability to perform actions such as sending unauthorized emails, deleting critical data, accessing confidential information, or establishing persistent access to user accounts. The attack requires minimal user interaction beyond opening a malicious SVG file, making it particularly effective in phishing campaigns or social engineering attacks where users might encounter seemingly legitimate documents. The vulnerability affects the core functionality of both Mail and Drive applications, which are fundamental components of the Open-Xchange platform, potentially compromising large numbers of users within organizations that utilize these services. Organizations may experience significant data loss, unauthorized access to sensitive communications, and potential lateral movement within their network infrastructure, as the malicious code operates with the full privileges of the authenticated user session. The vulnerability's impact is amplified by the fact that it can be exploited through various attack vectors including email attachments, shared documents, or any scenario where users might encounter SVG files through the web application interface, making it a persistent threat that requires immediate remediation.