CVE-2023-26438 : Security Advisory and Response

This CVE-2023-26438 was published on August 2, 2023, and was last updated on January 12, 2024, by OX Software GmbH.

Understanding CVE-2023-26438

This vulnerability in the OX App Suite involved external service lookups for various protocols being susceptible to a time-of-check/time-of-use (TOCTOU) weakness associated with the JDK DNS cache. Attackers could bypass existing network deny-lists and potentially discover restricted network infrastructure and service availability.

What is CVE-2023-26438?

The vulnerability allowed attackers to inject configuration by accurately timing the DNS cache expiry, enabling them to bypass network deny-lists and expose restricted network infrastructure and service availability.

The Impact of CVE-2023-26438

The exploit could result in revealing sensitive network information and potentially circumventing existing security measures within the affected systems.

Technical Details of CVE-2023-26438

The vulnerability was classified under CWE-918 Server-Side Request Forgery (SSRF) and had a CVSS v3.1 base score of 4.3, indicating a medium severity level with low confidentiality impact and no availability impact.

Vulnerability Description

Attacks could exploit the TOCTOU weakness in external service lookups, allowing them to discover restricted network infrastructure due to inadequate deny-list validation.

Affected Systems and Versions

The affected product was OX App Suite with versions lower than or equal to 7.10.6-rev42 and 8.10. Both versions were susceptible to the vulnerability.

Exploitation Mechanism

By correctly timing the DNS cache expiry, attackers could inject configuration to bypass existing network deny-lists, potentially exposing restricted network infrastructure.

Mitigation and Prevention

To address CVE-2023-26438, it is essential to implement immediate steps and long-term security practices.

Immediate Steps to Take

Update OX App Suite to versions that include the necessary improvements to prevent the exploitation of the vulnerability.
Monitor network traffic for any suspicious activity that may indicate an attempt to exploit the TOCTOU weakness.

Long-Term Security Practices

Regularly update and patch software to ensure that known vulnerabilities are addressed promptly.
Conduct security assessments and audits to identify and remediate any potential weaknesses in the network configuration.

Patching and Updates

Refer to the provided vendor advisory and release notes for the appropriate patches and updates to mitigate the CVE-2023-26438 vulnerability and enhance the security of the OX App Suite software.