CVE-2023-26445

Vulnerability

An XSS vulnerability exists in OX App Suite (OXAS) where frontend themes are defined by user-controllable jslob settings. An attacker can set a theme value pointing to a malicious resource, which gets processed during login. Versions prior to the fix are affected. The theme value is now sanitized and falls back to a default if no match is found [1].

Exploitation

To exploit, an attacker needs temporary access to a user's account or must lure a user to a compromised account. The attacker sets a malicious theme via the jslob settings, and when the victim logs in, the malicious resource is processed, executing script code in the victim's browser [1].

Impact

Successful exploitation leads to execution of malicious script code in the victim's context. This can result in session hijacking or triggering unwanted actions via the web interface and API [1].

Mitigation

Oxygen has addressed the issue by sanitizing the theme value and using a default fallback if no theme matches. The fix is included in newer versions. No workarounds are detailed, and there are no known public exploits [1].