CVE-2023-26441

Vulnerability

The vulnerability resides in the Cacheservice component of OX App Suite. The service fails to properly validate that relative cache object paths are contained within the defined absolute root directory, allowing path traversal. This affects versions prior to the security update that introduced improved path validation [1].

Exploitation

An attacker must have access to the database and be positioned on a local or restricted network. By crafting cache object references with relative path components (e.g., ../), the attacker can escape the intended root directory and access arbitrary files on the filesystem. No user interaction is required beyond the initial access conditions [1].

Impact

Successful exploitation allows the attacker to read any local file system resource that is accessible by the services system user account. This leads to information disclosure of sensitive data, such as configuration files, credentials, or other application data [1].

Mitigation

The vendor has addressed the issue by implementing proper path validation to ensure all cache object accesses are confined to the defined root directory. Users should apply the latest security update for OX App Suite. No publicly available exploits are known, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog [1].