CVE-2023-29048: Remote Code Execution via OXMF Template Injection in Open-Xchange App Suite

Vulnerability Summary

• CVE ID: CVE-2023-29048

• Severity: High (CVSS 3.1 Score: 8.8)

• Attack Vector: Network

• Privileges Required: Low

• User Interaction: None

• Impact: Remote Code Execution (RCE)

Affected Products

How the Exploit Works

CVE-2023-29048 is a command injection vulnerability in the Open-Xchange App Suite, specifically within the OXMF (Open-Xchange Markup Format) template parser. The parser fails to properly sanitize user-supplied input, allowing attackers with low privileges to inject and execute arbitrary system commands. These commands run under the context of the non-privileged runtime user, potentially leading to unauthorized access to sensitive information and modification of system resources.​Tenable®+4CVE+4documentation.open-xchange.com+4documentation.open-xchange.com+3SecLists+3CVE+3

The vulnerability arises from improper neutralization of special elements used in OS command execution (CWE-78). By crafting malicious OXMF templates, an attacker can exploit this flaw to execute system-level commands without requiring user interaction.​documentation.open-xchange.com+1SecLists+1

Conceptual Example Code

While specific exploit code is not publicly available, a conceptual example involves an attacker creating a malicious OXMF template containing embedded system commands. This template, when processed by the vulnerable parser, could execute commands like:​SecLists+3CVE+3NVD+3

In this example, the injected command fetches and executes a script from a remote server, potentially compromising the system.​

Potential Risks

• Execution of arbitrary system commands​SecLists+3NVD+3CVE+3

• Unauthorized access to confidential information​CVE

• Modification of system resources​CVE+1SecLists+1

• Potential for further exploitation or lateral movement within the network​

Mitigation Recommendations

• Update the Software: Upgrade to Open-Xchange App Suite backend version 7.10.6-rev51 or later, where the vulnerability has been patched.​Tenable®+3SecLists+3documentation.open-xchange.com+3

• Restrict Template Processing: Limit the ability to upload or process OXMF templates to trusted users only.​CVE+3NVD+3documentation.open-xchange.com+3

• Implement Input Validation: Ensure that all user-supplied input is properly sanitized and validated before processing.​

• Monitor System Activity: Regularly audit system logs and monitor for unusual activities that could indicate exploitation attempts.​

Conclusion

CVE-2023-29048 is a critical vulnerability in the Open-Xchange App Suite that allows low-privileged users to execute arbitrary system commands through malicious OXMF templates. Organizations using affected versions should promptly apply the recommended updates and implement additional security measures to mitigate potential risks.​

References

• NVD – CVE-2023-29048

• Open-Xchange Security Advisory OXAS-ADV-2023-0005

• Full Disclosure Mailing List – OXAS-ADV-2023-0005

• Tenable CVE-2023-29048 CPEs