CVE-2023-26450

Vulnerability

The OX Count web service, part of the OX App Suite, fails to specify a media-type when processing responses from external resources. This vulnerability affects versions prior to the fix released in 2023. An attacker can inject malicious script code that executes within the victim's browser context. The issue is described in the official advisory and external references [1].

Exploitation

An attacker requires temporary access to the user's account or must lure a user to interact with a compromised account. The exploit involves the attacker providing a crafted external resource that, when processed by the OX Count service, returns script code. The lack of a defined media-type allows the browser to interpret the response as executable script, leading to code execution in the victim's session [1]. No public exploit code is known, and the attack depends on user interaction or prior account access.

Impact

Successful exploitation results in arbitrary script execution within the victim's browser. This can lead to session hijacking, allowing the attacker to impersonate the user and trigger unwanted actions via the web interface and API. The impact is a compromise of confidentiality and integrity, with the attacker able to perform actions with the victim's privileges [1].

Mitigation

The vendor has addressed the vulnerability by defining the accepted media-type for external resource responses to prevent code execution. The fix was released in 2023. Users should update to the latest version of OX App Suite. No workarounds are detailed, and the CVE is not listed in the KEV catalog. For further details, refer to the vendor advisory and Packet Storm reference [1].