Open-Xchange OX AppSuite up to 7.6.3-rev2/7.8.2-rev3/7.8.3-rev4/7.8.4-rev3 Readerengine Spreadsheet Absolute path traversal

Summaryinfo

A vulnerability labeled as critical has been found in Open-Xchange OX AppSuite up to 7.6.3-rev2/7.8.2-rev3/7.8.3-rev4/7.8.4-rev3. This impacts an unknown function of the component Readerengine. Such manipulation as part of Spreadsheet leads to path traversal (Absolute). This vulnerability is uniquely identified as CVE-2018-5755. The attack can be launched remotely. Moreover, an exploit is present. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Open-Xchange OX AppSuite up to 7.6.3-rev2/7.8.2-rev3/7.8.3-rev4/7.8.4-rev3 (Groupware Software). Affected by this issue is an unknown part of the component Readerengine. The manipulation as part of a Spreadsheet leads to a path traversal vulnerability (Absolute). Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality. CVE summarizes:

Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.x before 7.8.2-rev4, 7.8.3 before 7.8.3-rev5, and 7.8.4 before 7.8.4-rev4 allows remote attackers to read arbitrary files via a full pathname in a formula in a spreadsheet.

The bug was discovered 06/08/2018. The weakness was disclosed 06/16/2018 as EDB-ID 44881 as not defined exploit (Exploit-DB). The advisory is shared for download at exploit-db.com. This vulnerability is handled as CVE-2018-5755 since 01/17/2018. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

After immediately, there has been an exploit disclosed. The exploit is available at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 7 days. During that time the estimated underground price was around $0-$5k.

Applying the patch 7.6.3-rev1/7.8.2-rev2/7.8.3-rev3/7.8.4-rev2 is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at Exploit-DB (44881). The entries VDB-119597, VDB-119609, VDB-119608 and VDB-119610 are pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Groupware Software

Vendor

• Open-Xchange

Name

• OX AppSuite

Version

• 7.6.3-rev2
• 7.8.2-rev3
• 7.8.3-rev4
• 7.8.4-rev3

License

• open-source

Website

• Vendor: https://www.open-xchange.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion