PT-2023-4164 · Unknown · Ox App Suite

Mdisec · Published 2023-06-20 · Updated 2024-01-12 · CVE-2023-26436

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OX App Suite (affected versions not specified)

Description The issue is related to a flaw in the deserialization mechanism of the OX App Suite package. Attackers with access to the "documentconverterws" API endpoint could inject serialized Java objects that were not properly checked during deserialization, allowing arbitrary code to be executed when processing the request. Access to this API endpoint is restricted to local networks by default. A check has been introduced to restrict processing of legal and expected classes for this API, and warnings are logged in case of attempts to inject illegal classes. No publicly available exploits are known.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Code Injection

Weakness Enumeration

CWE-502

CWE-94

Related Identifiers

BDU:2023-04476

CVE-2023-26436

Affected Products

Ox App Suite

References · 9

• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26436 · Security Note
• https://osv.dev/vulnerability/CVE-2023-26436 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04476 · Security Note
• http://seclists.org/fulldisclosure/2023/Jun/8 · Note
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf · Note
• http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html · Note
• https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0002.json · Note
• https://t.me/cvenotify/52850 · Telegram Post