Message-Id: <F0FCF706-DFD3-4BFB-B6A8-A28E876D4C38@open-xchange.com>
Date: Fri, 12 Jun 2020 10:06:18 +0200
From: Open-Xchange GmbH via Fulldisclosure <fulldisclosure@...lists.org>
To: fulldisclosure@...lists.org
Subject: [FD] Open-Xchange Security Advisory 2020-06-12

Dear subscribers,

we're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs for OX AppSuite, Dovecot and PowerDNS at HackerOne.

Yours sincerely,
Martin Heiland, Open-Xchange GmbH



Product: OX Guard
Vendor: OX Software GmbH



Internal reference: GUARD-179
Vulnerability type: Cross-Site Scripting (CWE-80)
Vulnerable version: 2.10.3
Vulnerable component: guard
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 2.10.2-rev9, 2.10.3-rev4
Vendor notification: 2020-02-04
Solution date: 2020-03-06
Public disclosure: 2020-06-12
CVE reference: CVE-2020-9426
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)

Vulnerability Details:
Comments within forged malicious public-keys could contain HTML and Javascript that was not properly sanitized before displaying at Guard settings. Through autocrypt and other mechanisms such keys could get imported without noticing their malicious content.

Risk:
Users can trigger API calls that invoke local URLs, if a host can be accessed a different error will be returned compared to unavailable hosts. This can be used to discover an internal network topology and services.

Steps to reproduce:
1. Create a PGP keypair
2. Use HTML and JS as part of the public keys comment section
3. Distribute this key through mail attachments, autocrypt or HKP

Solution:
We improved our sanitizing and ensure that external content such as comments are handled safely.



---



Internal reference: GUARD-182
Vulnerability type: Server-Side Request Forgery (CWE-918)
Vulnerable version: 2.10.3
Vulnerable component: guard
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 2.10.2-rev9, 2.10.3-rev4
Vendor notification: 2020-02-11
Solution date: 2020-03-06
Public disclosure: 2020-06-12
CVE reference: CVE-2020-9427
CVSS: 5.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)

Vulnerability Details:
HKP/HKPS key discovery mechanisms are based on DNS service records. Those are probed to look up unknown public-keys but were insufficiently checked for sensitive resource locations.

Risk:
In case of a malicious DNS server or domain, an attacker could use this technique to redirect HTTP requests to internal networks. Taking timing and response codes into consideration this can be used to determine if a specific port at a internal system is open or not, leading to basic network discovery capabilities for the attacker.

Steps to reproduce:
1. Setup a malicious domain with HKP/HKPS service records, point them to a malicious HKP responder
2. At the malicious HKP responder, issue HTTP redirects targetting internal hosts like 127.0.0.1

Solution:
We now run HKP responses through existing blacklist mechanisms to avoid accessing internal network resources.



---



Internal reference: GUARD-183
Vulnerability type: Server-Side Request Forgery (CWE-918)
Vulnerable version: 2.10.3
Vulnerable component: guard
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 2.10.2-rev9, 2.10.3-rev4
Vendor notification: 2020-02-11
Solution date: 2020-03-06
Public disclosure: 2020-06-12
CVE reference: CVE-2020-9427
CVSS: 5.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)

Vulnerability Details:
WKS/Webkey services discovery mechanisms are based on DNS service records. Those are probed to look up unknown public-keys but were insufficiently checked for sensitive resource locations.

Risk:
In case of a malicious DNS server or domain, an attacker could use this technique to redirect HTTP requests to internal networks. Taking timing and response codes into consideration this can be used to determine if a specific port at a internal system is open or not, leading to basic network discovery capabilities for the attacker. Mind that this attack gets mitigated when using DNSSEC, but depending on configuration this might get bypassed or not used.

Steps to reproduce:
1. Setup a malicious domain with WKS/Webkey service records, point them to a malicious WKS responder
2. At the malicious WKS responder, issue HTTP redirects targetting internal hosts like 127.0.0.1

Solution:
We now run WKS responses through existing blacklist mechanisms to avoid accessing internal network resources.


Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists