CVE-2018-5752

An attacker with a valid user account sets up a malicious HTTP service that responds with an HTTP 301 redirect pointing to a local or internal IP address (using non-decimal or special IPv6 address formats). The attacker then attempts to add an external mail account whose domain resolves to the attacker's malicious service. When the OX App Suite backend follows the redirect during auto-configuration lookup, it makes requests to internal network endpoints. By observing error codes and response times of the /api/autoconfig?action=get request, the attacker can probe internal network configuration, open ports, and services [ref_id=1].

The vulnerability resides in the backend component of OX App Suite, specifically in the auto-configuration logic that looks up external mail account configuration via XML files hosted at mail providers' hosts [ref_id=1]. The advisory does not specify exact file paths or function names.

The vendor fixed the vulnerability by denying access to network-internal endpoints when following HTTP redirects during the auto-configuration process [ref_id=1]. The advisory states: "We now deny access to network internal endpoints when following HTTP redirects" [ref_id=1]. No patch diff is provided in the bundle, but the fix was released in versions 7.6.3-rev36, 7.8.2-rev39, 7.8.3-rev44, and 7.8.4-rev22 [ref_id=1].

1. Provide a malicious HTTP service that redirects any incoming request to a local IP/Port combination using HTTP 301. 2. Attempt to add an external mail account that uses the same domain as the malicious HTTP service. 3. Check error codes and response times of the /api/autoconfig?action=get request [ref_id=1].