CVE-2023-29051: Unauthorized Access and Modification of Application State in OX App Suite

Overview

The vulnerability CVE-2023-29051, recently discovered in the OX App Suite, allows unauthorized users to access and modify the application state, including objects related to other users and contexts. This is due to an ineffective switch that should disable user-defined OXMF templates by default. The OX App Suite is widely used for email, collaboration, and productivity, affecting a vast user base. This vulnerability is of significant concern, as it opens up potential system compromise or data leakage, putting sensitive information at risk.

Vulnerability Summary

CVE ID: CVE-2023-29051
Severity: High (8.1)
Attack Vector: Remote
Privileges Required: None
User Interaction: None
Impact: Unauthorized access to application state, potential system compromise, and data leakage

Affected Products

Product | Affected Versions

OX App Suite | All versions prior to the patch

How the Exploit Works

The vulnerability lies in user-defined OXMF templates that can tap into a limited part of the internal OX App Suite Java API. The existing switch that should disable these templates by default is not effective, allowing unauthorized users to access and modify the application state. This includes objects related to other users and contexts. It’s important to note that the vulnerability can be exploited remotely, without any user interaction or special privileges.

Conceptual Example Code

Although no public exploits are known at this time, the following is a conceptual example of how this vulnerability might be exploited:

// Pseudo code to demonstrate exploitation of CVE-2023-29051
OXMF_Template template = new OXMF_Template("malicious_template");
template.setAccessible(true); // Bypasses the switch that should disable the template
// Accesses the internal OX App Suite Java API
InternalAPI api = template.getInternalAPI();
// Modifies the application state
api.modifyApplicationState("target_user", "malicious_modifications");

The code above represents a hypothetical exploit where a malicious OXMF template is created, made accessible, and then used to access the internal API and modify the application state for a target user.