{"uuid": "8c46015a-b1e1-4376-840f-de12feb59b85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23099", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/62552", "content": "Exploit Collector\nOpen-Xchange App Suite 7.10.x Cross Site Scripting / Command Injection\n\nhttps://4.bp.blogspot.com/-dyIqvjR3K84/WWlvfXt5NkI/AAAAAAAAIQA/Fvmwfk3J4TgcxqdY3USv0_rN_ZW9VtW1ACLcBGAs/s1600/h85.png \nOpen-Xchange App Suite versions 7.10.6 and below suffer from OS command injection and cross site scripting vulnerabilities. One particular cross site scripting issue only affects versions 7.10.5 and below.\n\nSHA-256 | 145c2f74cfe9370dfbec4b0f72f06c5a67138afef07940be7a7e97d9a4b1f072\n\nDownload\nProduct: OX App Suite\nVendor: OX Software GmbH\nInternal reference: DOCS-4106\nVulnerability type: OS Command Injection (CWE-78)\nVulnerable version: 7.10.6 and earlier\nVulnerable component: documentconverter\nReport confidence: Confirmed\nSolution status: Fixed by Vendor\nFixed version: 7.8.4-rev13, 7.10.3-rev6, 7.10.4-rev6, 7.10.5-rev5, 7.10.6-rev3\nVendor notification: 2022-01-10\nSolution date: 2022-01-13\nPublic disclosure: 2022-07-21\nCVE reference: CVE-2022-23100\nCVSS: 8.2 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L)\n\nVulnerability Details:\nOX Documentconverter has a Remote Code Execution flaw that allows authenticated OX App Suite users to run commands on the instance which runs OX Documentconverter if they have the ability to perform document conversions, for example of E-Mail attachments or OX Drive content.\n\nRisk:\nAttackers can inject arbitrary operating-system level commands via OX App Suite API and/or OX Documentconverter API. Commands are executed on the instance running OX Documentconverter, based on \"open-xchange\" user privileges. This can be used to modify or exfiltrate configuration files as well as adversely affect the instances availability by excessive resource usage. By default the vulnerable Documentconverter API is not publicly accessible, however this might be worked around by abusing other weaknesses, configuration flaws or social engineering.\n\nSteps to reproduce:\n1. Create a forged Documentconverter API call that embeds escape characters and a system command\n2. Inject the malicious API call via App Suite as a proxy or other means\n\nSolution:\nWe reduceed available API parameters to a limited set of enumerations, rather than accepting API input.\n---\nInternal reference: MWB-1350\nVulnerability type: Cross-Site Scripting (CWE-80)\nVulnerable version: 7.10.6 and earlier\nVulnerable component: backend\nReport confidence: Confirmed\nSolution status: Fixed by Vendor\nFixed version: 7.8.4-rev78, 7.10.3-rev38, 7.10.4-rev31, 7.10.5-rev37, 7.10.6-rev9\nVendor notification: 2021-11-30\nSolution date: 2022-02-15\nPublic disclosure: 2022-07-21\nCVE reference: CVE-2022-23099\nCVSS: 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)\n\nVulnerability Details:\nExisting sanitization and filtering mechanisms for HTML files can be bypassed by forcing block-wise read. Using this technique, the recognition procedure misses to detect tags and attributes that span multiple blocks.\n\nRisk:\nMalicious script code can be executed within a users context. This can lead to session hijacking or triggering unwanted actions via the web interface (e.g. redirecting to a third-party site). To exploit this an attacker would require the victim to follow a hyperlink.\n\nSteps to reproduce:\n1. As attacker, create a HTML malicious code-snippet which masks tags (e.g.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:44.391181Z"}