CVE-2023-26430: open-xchange open-xchange_appsuite_backend Command Injection

Vulnerability summary

CVE-2023-26430 is a medium (CVSS 4.3) Command Injection vulnerability in open-xchange open-xchange_appsuite_backend. EPSS estimates a 0.75% chance of exploitation in the next 30 days, higher than 54.4% of scored vulnerabilities.

Timeline

1. 02-08-2023
   PublishedVulnerability first disclosed.
2. 15-10-2024
   Last modifiedVulnerability information updated.

Description

Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE extension that are not allowed by App Suite or to inject rules which would break per-user filter processing, requiring manual cleanup of such rules. We have added sanitization to all mail-filter APIs to avoid forwardning control characters to subsystems. No publicly available exploits are known.

• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.