CVE-2023-26442

In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attacker with access to a local or restricted network with the capability to intercept and replay HTTP requests to sproxyd (or who is in control of the sproxyd service) could perform a server-side request-forgery attack and make Cacheservice connect to unexpected resources. We have disabled the ability to follow HTTP redirects when connecting to sproxyd resources. No publicly available exploits are known.

CVSS v3 3.2 LOW

3.2^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.4 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html	Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2023/Aug/8	Mailing List Third Party Advisory
https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:open-xchange:open-xchange_appsuite_office:*:*:*:*:*:*:*:*

History

12 Jan 2024, 08:15

Type	Values Removed	Values Added
References	~~{'url': 'https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0003.json', 'tags': ['Vendor Advisory'], 'source': 'security@open-xchange.com'}~~	() https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json -

Information

Published : 2023-08-02 13:15

Updated : 2024-01-12 08:15

NVD link : CVE-2023-26442

Mitre link : CVE-2023-26442

CVE.ORG link : CVE-2023-26442

JSON object : View

Products Affected

open-xchange

open-xchange_appsuite_office

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2023-26442", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.2, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.4}, {"type": "Secondary", "source": "security@open-xchange.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.2, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.4}]}, "published": "2023-08-02T13:15:10.640", "references": [{"url": "http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@open-xchange.com"}, {"url": "http://seclists.org/fulldisclosure/2023/Aug/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@open-xchange.com"}, {"url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json", "source": "security@open-xchange.com"}, {"url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf", "tags": ["Release Notes"], "source": "security@open-xchange.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-918"}]}, {"type": "Secondary", "source": "security@open-xchange.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attacker with access to a local or restricted network with the capability to intercept and replay HTTP requests to sproxyd (or who is in control of the sproxyd service) could perform a server-side request-forgery attack and make Cacheservice connect to unexpected resources. We have disabled the ability to follow HTTP redirects when connecting to sproxyd resources. No publicly available exploits are known.\n\n"}], "lastModified": "2024-01-12T08:15:41.630", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite_office:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD01E9AA-CCA9-4BD5-A12F-9CC9C977EACE", "versionEndExcluding": "8.11"}], "operator": "OR"}]}], "sourceIdentifier": "security@open-xchange.com"}