Open-Xchange OX AppSuite up to 7.8.0-rev26 Portal aria-label cross site scripting

Summaryinfo

A vulnerability was found in Open-Xchange OX AppSuite up to 7.8.0-rev26. It has been classified as problematic. This issue affects some unknown processing of the component Portal. The manipulation of the argument aria-label leads to cross site scripting. This vulnerability is referenced as CVE-2016-3173. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Open-Xchange OX AppSuite up to 7.8.0-rev26 (Groupware Software) and classified as problematic. This issue affects an unknown code block of the component Portal. The manipulation of the argument aria-label with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:

An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The aria-label parameter of tiles at the Portal can be used to inject script code. Those labels use the name of the file (e.g. an image) which gets displayed at the portal application. Using script code at the file name leads to script execution. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). Users actively need to add a file to the portal to enable this attack. In case of shared files however, a internal attacker may modify a previously embedded file to carry a malicious file name. Furthermore this vulnerability can be used to persistently execute code that got injected by a temporary script execution vulnerability.

The bug was discovered 05/25/2016. The weakness was published 12/15/2016 (Website). The advisory is shared at packetstormsecurity.com. The identification of this vulnerability is CVE-2016-3173 since 03/15/2016. The attack may be initiated remotely. The requirement for exploitation is a simple authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 204 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 7.8.0-rev27 eliminates this vulnerability.

Similar entry is available at VDB-94506. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Groupware Software

Vendor

• Open-Xchange

Name

• OX AppSuite

Version

• 7.8.0-rev26

License

• open-source

Website

• Vendor: https://www.open-xchange.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion