CVE-2017-2146

Vulnerability

Cybozu Garoon versions 3.0.0 to 4.2.4 contain a cross-site scripting (XSS) vulnerability in the application menu. The bug resides in insufficient sanitization of user-supplied input, which allows an authenticated attacker with high privileges to inject arbitrary web script or HTML. The vulnerable code path is triggered when a privileged user creates or customizes an application menu entry, and the crafted input is then rendered when other users view the menu. [1]

Exploitation

An attacker must have a high-privileged account (e.g., administrator role) in the Cybozu Garoon instance. The attacker crafts a malicious application menu entry containing JavaScript or HTML payload. When a logged-in user (including the attacker themselves) navigates to the affected menu, the injected script executes in the context of the victim's browser session. The attack requires no additional network access beyond being authenticated to the application, but does require the victim user to interact with the menu item. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary web script or HTML in the victim's browser. This can lead to session token theft, forced actions (such as modifying or locking other users' files), or exfiltration of sensitive data displayed in the Garoon interface. The attacker gains the ability to perform actions with the victim's privileges, potentially escalating their access within the application. [1]

Mitigation

Cybozu has released a fixed version; users should update Cybozu Garoon to the latest version provided by the vendor. No workarounds or patches are listed in the JPCERT/CC advisory for this specific CVE. [1]