CVE-2014-5236

Vulnerability

The documentconverter component in Open-Xchange (OX) AppSuite versions before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 contains multiple absolute path traversal vulnerabilities [1]. By crafting an OpenDocument text file with a full pathname in an OLE Object or an image, a remote attacker can read arbitrary application files.

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted OpenDocument text file to a target server running a vulnerable version of OX AppSuite. No authentication is required if the documentconverter is exposed to unauthenticated users. The attacker includes a full pathname (e.g., /etc/passwd) in the OLE Object or image element. When the documentconverter processes the file, it follows the absolute path and reads the specified file.

Impact

Successful exploitation allows an attacker to read arbitrary application files on the server, potentially leading to disclosure of sensitive configuration data, credentials, or other confidential information. The impact is limited to file read; no code execution is reported.

Mitigation

The vulnerability is fixed in OX AppSuite versions 7.4.2-rev10 and 7.6.0-rev10. Users should upgrade to these versions or later. No workarounds are documented in the available references. The CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.