CVE-2023-26438: open-xchange open-xchange_appsuite_backend Server-Side Request Forgery (SSRF)

Vulnerability summary

CVE-2023-26438 is a medium (CVSS 4.3) Server-Side Request Forgery (SSRF) vulnerability in open-xchange open-xchange_appsuite_backend. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.7% of scored vulnerabilities.

Timeline

1. 02-08-2023
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache. Attackers that were timing DNS cache expiry correctly were able to inject configuration that would bypass existing network deny-lists. Attackers could exploit this weakness to discover the existence of restricted network infrastructure and service availability. Improvements were made to include deny-lists not only during the check of the provided connection data, but also during use. No publicly available exploits are known.

• CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
• CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.