Open-Xchange OX AppSuite Backend server-side request forgery

Summaryinfo

A vulnerability was found in Open-Xchange OX AppSuite up to 7.6.3-rev35/7.8.3-rev38/7.8.3-rev43/7.8.4-rev21. It has been rated as critical. The affected element is an unknown function of the component Backend. The manipulation leads to server-side request forgery. This vulnerability is traded as CVE-2018-5752. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in Open-Xchange OX AppSuite up to 7.6.3-rev35/7.8.3-rev38/7.8.3-rev43/7.8.4-rev21 (Groupware Software). It has been rated as critical. This issue affects an unknown function of the component Backend. The manipulation with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors involving non-decimal representations of IP addresses and special IPv6 related addresses.

The bug was discovered 06/08/2018. The weakness was shared 06/16/2018 as EDB-ID 44881 as not defined exploit (Exploit-DB). The advisory is shared at exploit-db.com. The identification of this vulnerability is CVE-2018-5752 since 01/17/2018. The exploitation is known to be easy. The attack may be initiated remotely. The successful exploitation requires a simple authentication. Technical details are unknown but a public exploit is available.

After immediately, there has been an exploit disclosed. The exploit is available at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 7 days. During that time the estimated underground price was around $0-$5k.

Applying the patch 7.6.3-rev36/7.8.3-rev39/7.8.3-rev44/7.8.4-rev22 is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at Exploit-DB (44881). The entries VDB-119597, VDB-119608, VDB-119610 and VDB-119611 are related to this item. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Groupware Software

Vendor

• Open-Xchange

Name

• OX AppSuite

Version

• 7.6.3-rev35
• 7.8.3-rev38
• 7.8.3-rev43
• 7.8.4-rev21

License

• open-source

Website

• Vendor: https://www.open-xchange.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion