Full Disclosure mailing list archives

Dear subscribers,

We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those 
vulnerabilities. Feel free to join our bug bounty programs for OX App Suite, Dovecot and PowerDNS at YesWeHack.

This advisory has also been published at 
https://documentation.open-xchange.com/appsuite/security/advisories/html/2024/oxas-adv-2024-0003.html.

Yours sincerely,
  Martin Heiland, Open-Xchange GmbH



Internal reference: MWB-2525
Type: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
Component: backend
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX App Suite backend 7.10.6-rev61, OX App Suite backend 8.22
First fixed revision: OX App Suite backend 7.10.6-rev62, OX App Suite backend 8.23
Discovery date: 2024-03-01
Solution date: 2024-04-11
CVE: CVE-2024-25710
CVSS: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Details:
Apache Commons Compress library is prone to a denial of service (DoS) vulnerability.. Loop with Unreachable Exit 
Condition ('Infinite Loop') vulnerability in Apache Commons Compress. This issue affects a Apache Commons Compress 
library shipped with OX App Suite.

Risk:
The vulnerability can potentially be exploited through OX App Suite and affect availability of the service. No publicly 
available exploits are known.

Solution:
Please deploy the provided updates and patch releases. We have updated the vulnerable library as a precaution to avoid 
potential exploitation.



---



Internal reference: OXUIB-2718
Type: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
Component: frontend
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX App Suite frontend 7.10.6-rev42
First fixed revision: OX App Suite frontend 7.10.6-rev43
Discovery date: 2024-01-30
Solution date: 2024-04-04
CVE: CVE-2024-25582
CVSS: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Details:
XSS using arbitrary relative path to UI module. Module savepoints could be abused to inject references to malicious 
code delivered through the same domain.

Risk:
Attackers could perform malicious API requests or extract information from the users account. Exploiting this 
vulnerability requires temporary access to an account or successful social engineering to make a user follow a prepared 
link to a malicious account. No publicly available exploits are known.

Solution:
Please deploy the provided updates and patch releases. The savepoint module path has been restricted to modules that 
provide the feature, excluding any arbitrary or non-existing modules.



---



Internal reference: OXUIB-2699
Type: CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))
Component: frontend
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX App Suite frontend 7.10.6-rev42
First fixed revision: OX App Suite frontend 7.10.6-rev43
Discovery date: 2024-01-15
Solution date: 2024-03-28
CVE: CVE-2021-41184
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Details:
Outdated jquery-ui shipped with 7.10.6. JQuery third-party components with known vulnerabilities have been shipped.

Risk:
This update serves as a preventive measure since no practical exploitation in the context of OX App Suite is feasible. 
No publicly available exploits are known.

Solution:
Please deploy the provided updates and patch releases. The relevant components have been updated to mitigate potential 
exploitation.

Attachment: signature.asc
Description:

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Current thread:

• OXAS-ADV-2024-0003: OX App Suite Security Advisory Martin Heiland via Fulldisclosure (Aug 22)