CVE-2016-5740

Vulnerability

A cross-site scripting (XSS) vulnerability exists in Open-Xchange OX App Suite versions before 7.8.2-rev5. The bug resides in the handling of iCal attachments within scheduling emails and in resource descriptions. Malicious JavaScript code can be embedded in appointment fields (e.g., location) or resource descriptions. When a user views the appointment details, the script executes in the context of the user's current session. Affected versions include all releases prior to the fixed versions: 7.6.2-rev46, 7.6.3-rev14, 7.8.0-rev29, 7.8.1-rev16, and 7.8.2-rev5 for the frontend component, and similar versions for the backend.

Exploitation

An attacker can exploit this vulnerability by sending a scheduling email containing a crafted iCal attachment with embedded JavaScript, or by creating or modifying a resource with a malicious description. The attacker does not need authentication but requires the ability to send emails to the target or to have permissions to create/modify resources (though explicit permissions are needed for resource modification). The attack requires user interaction: the victim must open the email and view the appointment details. The script executes within the victim's session, allowing the attacker to perform actions on behalf of the user [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, unauthorized actions such as sending emails, deleting data, or other operations accessible via the web interface. The impact is limited to the privileges of the victim user; no privilege escalation occurs.

Mitigation

The vendor has released fixed versions: 7.6.2-rev46, 7.6.3-rev14, 7.8.0-rev29, 7.8.1-rev16, and 7.8.2-rev5 for the frontend, and corresponding updates for the backend. Operators should update to the latest patch release. As a workaround, permission settings can be tightened to reject resource modifications by users. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog [1].