OX Guard 2.10.3 Cross Site Scripting / Server-Side Request Forgery

`Product: OX Guard  
Vendor: OX Software GmbH  
  
  
  
Internal reference: GUARD-179  
Vulnerability type: Cross-Site Scripting (CWE-80)  
Vulnerable version: 2.10.3  
Vulnerable component: guard  
Report confidence: Confirmed  
Solution status: Fixed by Vendor  
Fixed version: 2.10.2-rev9, 2.10.3-rev4  
Vendor notification: 2020-02-04  
Solution date: 2020-03-06  
Public disclosure: 2020-06-12  
CVE reference: CVE-2020-9426  
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)  
  
Vulnerability Details:  
Comments within forged malicious public-keys could contain HTML and Javascript that was not properly sanitized before displaying at Guard settings. Through autocrypt and other mechanisms such keys could get imported without noticing their malicious content.  
  
Risk:  
Users can trigger API calls that invoke local URLs, if a host can be accessed a different error will be returned compared to unavailable hosts. This can be used to discover an internal network topology and services.  
  
Steps to reproduce:  
1. Create a PGP keypair  
2. Use HTML and JS as part of the public keys comment section  
3. Distribute this key through mail attachments, autocrypt or HKP  
  
Solution:  
We improved our sanitizing and ensure that external content such as comments are handled safely.  
  
  
  
---  
  
  
  
Internal reference: GUARD-182  
Vulnerability type: Server-Side Request Forgery (CWE-918)  
Vulnerable version: 2.10.3  
Vulnerable component: guard  
Report confidence: Confirmed  
Solution status: Fixed by Vendor  
Fixed version: 2.10.2-rev9, 2.10.3-rev4  
Vendor notification: 2020-02-11  
Solution date: 2020-03-06  
Public disclosure: 2020-06-12  
CVE reference: CVE-2020-9427  
CVSS: 5.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)  
  
Vulnerability Details:  
HKP/HKPS key discovery mechanisms are based on DNS service records. Those are probed to look up unknown public-keys but were insufficiently checked for sensitive resource locations.  
  
Risk:  
In case of a malicious DNS server or domain, an attacker could use this technique to redirect HTTP requests to internal networks. Taking timing and response codes into consideration this can be used to determine if a specific port at a internal system is open or not, leading to basic network discovery capabilities for the attacker.  
  
Steps to reproduce:  
1. Setup a malicious domain with HKP/HKPS service records, point them to a malicious HKP responder  
2. At the malicious HKP responder, issue HTTP redirects targetting internal hosts like 127.0.0.1  
  
Solution:  
We now run HKP responses through existing blacklist mechanisms to avoid accessing internal network resources.  
  
  
  
---  
  
  
  
Internal reference: GUARD-183  
Vulnerability type: Server-Side Request Forgery (CWE-918)  
Vulnerable version: 2.10.3  
Vulnerable component: guard  
Report confidence: Confirmed  
Solution status: Fixed by Vendor  
Fixed version: 2.10.2-rev9, 2.10.3-rev4  
Vendor notification: 2020-02-11  
Solution date: 2020-03-06  
Public disclosure: 2020-06-12  
CVE reference: CVE-2020-9427  
CVSS: 5.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)  
  
Vulnerability Details:  
WKS/Webkey services discovery mechanisms are based on DNS service records. Those are probed to look up unknown public-keys but were insufficiently checked for sensitive resource locations.  
  
Risk:  
In case of a malicious DNS server or domain, an attacker could use this technique to redirect HTTP requests to internal networks. Taking timing and response codes into consideration this can be used to determine if a specific port at a internal system is open or not, leading to basic network discovery capabilities for the attacker. Mind that this attack gets mitigated when using DNSSEC, but depending on configuration this might get bypassed or not used.  
  
Steps to reproduce:  
1. Setup a malicious domain with WKS/Webkey service records, point them to a malicious WKS responder  
2. At the malicious WKS responder, issue HTTP redirects targetting internal hosts like 127.0.0.1  
  
Solution:  
We now run WKS responses through existing blacklist mechanisms to avoid accessing internal network resources.  
  
`