Open-Xchange: [SSRF] PDF documentconverterws

Hi. Previous report 260576 Example: F305199 /ppt/slides/rels/slide1.xml.rels: xml Result: F305196 Impact Scan network Read any file file:///home/example/test.odf...

Open-Xchange: command Injection in rawlog binary

Quick Overview I have found a Command Injection vulnerability in the code where a method calls an OS Shell command using an untrusted string to execute. Introduction Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable...

Open-Xchange: Buffer overflow in sha3

Quick Overview I have found a Buffer Overflow OutOfBand vulnerability in the code where a buffer used is not properly verified before writing data to the buffer. Introduction Buffer overflow attacks, in their various forms, could allow an attacker to control certain areas of memory. Typically, th...

Open-Xchange: [XSS] content_disposition=inline in files

Hi. No filter for application/ when contentdisposition=inline PoC: - 1. Auth https://sandbox.open-xchange.com/ajax/share/021f28560fbe7d5b21f28d3fbe7d42379932c8eb965ee141/1/8/NTc/NTcvMzQ4 2. XSS...

Open-Xchange: Referer in /servlet/TestServlet

Hi. No encode referer URL in https://sandbox.open-xchange.com/servlet/TestServlet You check , but i think you need just replace Steps 1. Upload file 2. Change mimetype to "file":"filemimetype":"text/x-javascript" 3. Share to All or Link, but then need insert Iframe, same as in 342585 4. Make URL...

Open-Xchange: [XSS] Style/Event Filter Bypass v4.0

Hi. I update today to 7.8.4 Rev28. And found new way - no filter before Previous reports 314204 Without // comment you checking: 1. As Object Payload: Result: 2. Сomma && empty object Payload: Result: Fix - I think you need replace all ' = &x27 if style='a"a&x27a' and replace all " = &x22 if...

Open-Xchange: [XSS] Parameter Theme

Hi. I found two cases via theme: inline fail && inject file done js $.when.applythis, g.thenfunction return g.mapfunctiona return a.responseText .join"/:oxsep:/" .donefunctionc 2 runCodeox.apiRoot, "/apps/load/", ox.version, ",", a.join"", c, e.completeLoadb, c.split"/:oxsep:/".eachfunctiona !...

Open-Xchange: [XSS] Forgot password link

Hi. 1. Go to without autologin: https://sandbox.open-xchange.com/appsuite/!!&forgot-password=javascript:alert1 2. Click: Forgot your password? No check parameter forgot-password in /apps/io.ox/core/boot/form.js: js function n $"io-ox-password-forget-form".remove; var a = .url.hash"forgot-password...

Open-Xchange: [XSS] select/onchange in TinyMCE via set body

Hi. TinyMCE allow insert . For set this content need special link: mailto:aaa?body=. Steps: 1. Go to compose mail 2. Insert URL: mailto:aaa?body=%3Cselect%20onchange%3D%22alertdocument.cookie%22%3E%3Coption%3E2%3C%2Foption%3E%3Coption%3E2%3C%2Foption%3E%3C%2Fselect%3E 3. Save Mail 4. Open this ma...

CVE-2014-2078

The backend in Open-Xchange OX AppSuite 7.4.2 before 7.4.2-rev9 allows remote attackers to obtain sensitive information about user email addresses in opportunistic circumstances by leveraging a failure in e-mail auto configuration for external accounts...

Open redirect

The backend in Open-Xchange OX AppSuite 7.4.2 before 7.4.2-rev9 allows remote attackers to obtain sensitive information about user email addresses in opportunistic circumstances by leveraging a failure in e-mail auto configuration for external accounts...

CVE-2014-2078

The backend in Open-Xchange OX AppSuite 7.4.2 before 7.4.2-rev9 allows remote attackers to obtain sensitive information about user email addresses in opportunistic circumstances by leveraging a failure in e-mail auto configuration for external accounts...

CVE-2014-2078

Open-Xchange AppSuite 7.4.2 is affected by CVE-2014-2078. The vulnerability arises when E-Mail auto configuration for external accounts fails, enabling remote attackers to obtain email addresses of other users under opportunistic circumstances. Affected component is the backend in AppSuite; explo...

CVE-2014-2078

The backend in Open-Xchange OX AppSuite 7.4.2 before 7.4.2-rev9 allows remote attackers to obtain sensitive information about user email addresses in opportunistic circumstances by leveraging a failure in e-mail auto configuration for external accounts...

Open-Xchange: Blind XXE via Powerpoint files

Summary During the parsing of Powerpoint files it seems that it is possible to include XXE payload which will be executed on the Open-XChange server. I was able to identify which files exist on the server, and cause the server make arbitrary request to my own server, and I am pretty sure it is al...

Open-Xchange: IDOR to view other user folder name

TESTED ACCOUNT: ================= [email protected] STEP TO REPRODUCE ==================== there is IDOR in viewing other user folder name GET...

Open-Xchange: [XSS] Pasting bootstrap in mail compose

Hi. No filter for bootstrap data attributes. data-target allow any html, e.g.: - " href="" collapse - " href="" dropdown - " href="" modal Steps: 1. Create page with this code best example with dropdown, you can use my template https://secator.com/ox/bootstrap.html 2. Ctrl+A select all, Ctrl+C co...

Open-Xchange: [XSS/CSRF] filter content-type bypass in Files v2.0

Hi. sandbox.open-xchange.com runs a version that contains a fix for your first report First report 304098 If you found a valid workaround, please open a new report, thanks : : Yeah, I tested now in sandbox. Steps: 1. Add Note with any html tags 2. Change Fileinfo: json...

Open-Xchange: [XSS/CSRF] filter content-type bypass in Files

Hi. I found trick for inject any content-type for files. If content-type contains , then browser Chrome, Firefox skip content-type before , e.g.: any, text/html - text/html Upload any html/xml/svg/swf without extension F253137 and update mimetype: - "file":"filemimetype":"t,text/html" -...

Open-Xchange: Arbitrary local system file read on open-xchange server

Hi, Summary: I found a vulnerability that can read arbritary local file and also internal resource on Open-Xchange server. Description: I can create an crafted odt file and can successfully read any local files on Open-Xchange server when previewing this odt file. Steps to Reproduce: Here is the...