We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs for OX App Suite, Dovecot and PowerDNS at YesWeHack.

This advisory has also been published at https://documentation.open-xchange.com/appsuite/security/advisories/html/2024/oxas-adv-2024-0003.html.

Yours sincerely,
Martin Heiland, Open-Xchange GmbH

Internal reference: MWB-2525
Type: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
Component: backend
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX App Suite backend 7.10.6-rev61, OX App Suite backend 8.22
First fixed revision: OX App Suite backend 7.10.6-rev62, OX App Suite backend 8.23
Discovery date: 2024-03-01
Solution date: 2024-04-11
CVE: CVE-2024-25710
CVSS: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Details:
Apache Commons Compress library is prone to a denial of service (DoS) vulnerability.. Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress. This issue affects a Apache Commons Compress library shipped with OX App Suite.

Risk:
The vulnerability can potentially be exploited through OX App Suite and affect availability of the service. No publicly available exploits are known.

Solution:
Please deploy the provided updates and patch releases. We have updated the vulnerable library as a precaution to avoid potential exploitation.

---

Internal reference: OXUIB-2718
Type: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
Component: frontend
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX App Suite frontend 7.10.6-rev42
First fixed revision: OX App Suite frontend 7.10.6-rev43
Discovery date: 2024-01-30
Solution date: 2024-04-04
CVE: CVE-2024-25582
CVSS: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Details:
XSS using arbitrary relative path to UI module. Module savepoints could be abused to inject references to malicious code delivered through the same domain.

Risk:
Attackers could perform malicious API requests or extract information from the users account. Exploiting this vulnerability requires temporary access to an account or successful social engineering to make a user follow a prepared link to a malicious account. No publicly available exploits are known.

Solution:
Please deploy the provided updates and patch releases. The savepoint module path has been restricted to modules that provide the feature, excluding any arbitrary or non-existing modules.

---

Internal reference: OXUIB-2699
Type: CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))
Component: frontend
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX App Suite frontend 7.10.6-rev42
First fixed revision: OX App Suite frontend 7.10.6-rev43
Discovery date: 2024-01-15
Solution date: 2024-03-28
CVE: CVE-2021-41184
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Details:
Outdated jquery-ui shipped with 7.10.6. JQuery third-party components with known vulnerabilities have been shipped.

Risk:
This update serves as a preventive measure since no practical exploitation in the context of OX App Suite is feasible. No publicly available exploits are known.

Solution:
Please deploy the provided updates and patch releases. The relevant components have been updated to mitigate potential exploitation.