CVE-2023-26448

Vulnerability

The vulnerability resides in custom log-in and log-out locations in OX App Suite. These locations are user-defined as jslob but were not sanitized for malicious protocol handlers. An attacker can inject malicious script code that executes in the victim's context. Affected versions are not explicitly listed in the description, but the fix was applied in a security update. [1]

Exploitation

To exploit, an attacker requires temporary access to the user's account or must lure a user to a compromised account. The attacker defines a custom login/logout location containing a malicious protocol handler (e.g., javascript:). When the victim accesses that location, the script executes. No publicly available exploits are known. [1]

Impact

Successful exploitation allows execution of arbitrary script code in the victim's browser within the OX App Suite context. This can lead to session hijacking, unauthorized actions via the web interface and API, and potential data compromise. [1]

Mitigation

The vendor has sanitized jslob content for those locations to prevent redirects to malicious content. Users should update to the latest version of OX App Suite that includes this fix. No workarounds are mentioned. The vulnerability is not listed on CISA's KEV. [1]