SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (E-mail Server)  >   Open-Xchange Vendors:   Open-Xchange Inc.
Open-Xchange Input Validation Flaw Permits Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1032202
SecurityTracker URL:  http://securitytracker.com/id/1032202
CVE Reference:   CVE-2015-1588   (Links to External Site)
Date:  Apr 27 2015
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 7.6.1 and prior
Description:   Two vulnerabilities were reported in Open-Xchange. A remote user can conduct cross-site scripting attacks.

The sanitation and cleaner engine does not properly filter HTML code from user-supplied input before displaying the input. A remote user can cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the Open-Xchange software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user. Version 7.6.1 is affected.

The vendor was notified on January 7, 2015.

The system does not properly filter HTML code from user-supplied input in inline-styles of HTML content before displaying the input. A remote user can cause arbitrary elements to be displayed by the target user's browser.

The vendor was notified on January 9, 2015.

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the Open-Xchange software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Solution:   The vendor has issued a fix (7.4.2-rev43, 7.6.0-rev38, 7.6.1-rev21).
Vendor URL:  www.open-xchange.com/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  Open-Xchange Security Advisory 2015-04-27

Product: Open-Xchange Server 6 / OX AppSuite
Vendor: Open-Xchange GmbH

Internal reference: 35982 (Bug ID)
Vulnerability type: Cross-Site Scripting (CWE-80)
Vulnerable version: 7.6.1
Vulnerable component: backend
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 7.6.1-rev21
Vendor notification: 2015-01-07
Solution date: 2015-03-02
CVE reference: CVE-2015-1588
CVSSv2: 5.7 (AV:N/AC:M/Au:N/C:P/I:N/A:N/E:POC/RL:U/RC:C/CDP:LM/TD:H/CR:ND/IR:ND/AR:ND)

Vulnerability Details:
The sanitation and cleaner engine of OX AppSuite can be exploitet to return valid script code that gets executed by certain browsers. Such filter evasion requires rather good kowledge of the filtering algorithm and carefully crafted script code.

Risk:
Malicious script code can be executed within a users context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). Potential attack vectors are E-Mail (via attachments) or Drive.

Solution:
Users should update to the latest patch releases 7.6.1-rev21 (or later).



Internal reference: 36024 (Bug ID)
Vulnerability type: Cross-Site Scripting (CWE-80)
Vulnerable version: 7.6.1 and earlier
Vulnerable component: backend
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 7.4.2-rev43, 7.6.0-rev38, 7.6.1-rev21
Vendor notification: 2015-01-09
Solution date: 2015-03-02
CVE reference: CVE-2015-1588
CVSSv2: 4.1 (AV:N/AC:M/Au:N/C:P/I:N/A:N/E:F/RL:U/RC:C/CDP:ND/TD:H/CR:ND/IR:ND/AR:ND)

Vulnerability Details:
Inline-styles of HTML content can be used to place a element at the complete viewport of the application. This element can be a hyperlink which may trick users to trust third party and potentially malicious content.

Risk:
The application can become unresponsible or unusable when selecting certain contant. Furthermore, users may get tricked to open hyperlinks or consume injected content (images, text) at unexpected places of the application for unsolicited advertising and social-engineering attacks.

Solution:
Users should update to the latest patch releases 7.4.2-rev43, 7.6.0-rev38, 7.6.1-rev21 (or later).
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC