Open-Xchange OX AppSuite up to 7.8.1-rev10 cross site scripting

Summaryinfo

A vulnerability was found in Open-Xchange OX AppSuite up to 7.8.1-rev10. It has been rated as problematic. The affected element is an unknown function. This manipulation causes cross site scripting. This vulnerability is tracked as CVE-2016-4026. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Open-Xchange OX AppSuite up to 7.8.1-rev10 (Groupware Software). It has been declared as problematic. Affected by this vulnerability is an unknown function. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. The summary by CVE is:

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The content sanitizer component has an issue with filtering malicious content in case invalid HTML code is provided. In such cases the filter will output a unsanitized representation of the content. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). Attackers can use this issue for filter evasion to inject script code later on.

The bug was discovered 06/22/2016. The weakness was disclosed 12/15/2016 (Website). It is possible to read the advisory at securityfocus.com. This vulnerability is known as CVE-2016-4026 since 04/15/2016. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 176 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 7.8.1-rev11 eliminates this vulnerability.

The entries VDB-94509, VDB-94510, VDB-94511 and VDB-94512 are pretty similar. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Groupware Software

Vendor

• Open-Xchange

Name

• OX AppSuite

Version

• 7.8.1-rev10

License

• open-source

Website

• Vendor: https://www.open-xchange.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion