{"id":27912,"date":"2025-04-20T15:24:58","date_gmt":"2025-04-20T15:24:58","guid":{"rendered":""},"modified":"2025-04-29T18:18:49","modified_gmt":"2025-04-29T18:18:49","slug":"cve-2023-29051-unauthorized-access-and-modification-of-application-state-in-ox-app-suite","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2023-29051-unauthorized-access-and-modification-of-application-state-in-ox-app-suite\/","title":{"rendered":"<strong>CVE-2023-29051: Unauthorized Access and Modification of Application State in OX App Suite<\/strong>"},"content":{"rendered":"<p><strong>Overview<\/strong><\/p>\n<p>The vulnerability CVE-2023-29051, recently discovered in the OX App Suite, allows unauthorized users to access and modify the application state, including objects related to other users and contexts. This is due to an ineffective switch that should disable user-defined OXMF templates by default. The OX App Suite is widely used for email, collaboration, and productivity, affecting a vast user base. This vulnerability is of significant concern, as it opens up <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-37297-vulnerability-in-ami-s-spx-leading-to-potential-system-compromise\/\"  data-wpil-monitor-id=\"33447\">potential system<\/a> compromise or data leakage, putting sensitive information at risk.<\/p>\n<p><strong>Vulnerability Summary<\/strong><\/p>\n<p>CVE ID: CVE-2023-29051<br \/>\nSeverity: High (8.1)<br \/>\nAttack Vector: Remote<br \/>\nPrivileges Required: None<br \/>\nUser Interaction: None<br \/>\nImpact: Unauthorized access to application state, potential system compromise, and <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-50350-broken-cryptographic-algorithm-leads-to-potential-data-leakage-in-hcl-dryice-myxalytics\/\"  data-wpil-monitor-id=\"33969\">data leakage<\/a><\/p>\n<p><strong>Affected Products<\/strong><\/p><div id=\"ameeb-824863525\" class=\"ameeb-content-2 ameeb-entity-placement\"><div style=\"border-left: 4px solid #555; padding-left: 20px; margin: 48px 0; font-family: Roboto, sans-serif; color: #ffffff; line-height: 1.6; max-width: 700px;\">\r\n  <h2 style=\"margin-top: 0; font-size: 20px; font-weight: 600; display: flex; align-items: center;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"display: inline-flex; align-items: center; margin-right: 8px;\">\r\n      <img decoding=\"async\" src=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/10\/Best-App-icon-Ameeba.png\" alt=\"Ameeba Chat Icon\" style=\"width: 40px; height: 40px;\" \/>\r\n    <\/a>\r\n    A new way to communicate\r\n  <\/h2>\r\n\r\n  <p style=\"margin-bottom: 12px;\">\r\n    Ameeba Chat is built on encrypted identity, not personal profiles.\r\n  <\/p>\r\n\r\n  <p style=\"margin-bottom: 16px;\">\r\n    Message, call, share files, and coordinate with identities kept separate.\r\n  <\/p>\r\n\r\n  <ul style=\"list-style: none; padding-left: 0; margin-bottom: 20px;\">\r\n    <li>\u2022 Encrypted identity<\/li>\r\n    <li>\u2022 Ameeba Chat authenticates access<\/li>\r\n    <li>\u2022 Aliases and categories<\/li>\r\n    <li>\u2022 End-to-end encrypted chat, calls, and files<\/li>\r\n    <li>\u2022 Secure notes for sensitive information<\/li>\r\n  <\/ul>\r\n\r\n  <p style=\"font-style: italic; font-weight: 600; margin-bottom: 24px;\">\r\n    Private communication, rethought.\r\n  <\/p>\r\n\r\n  <div style=\"display: flex; flex-wrap: wrap; gap: 12px;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\/download\" style=\"background-color: #ffffff; color: #000000; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Download Ameeba Chat<\/a>\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"border: 1px solid #ffffff; color: #ffffff; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Learn More<\/a>\r\n  <\/div>\r\n<\/div>\r\n<\/div>\n<p>Product | Affected Versions<\/p>\n<p>OX App Suite | All <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-52307-high-severity-stack-overflow-vulnerability-in-paddlepaddle-prior-to-version-2-6-0\/\"  data-wpil-monitor-id=\"33968\">versions prior<\/a> to the patch<\/p>\n<p><strong>How the Exploit Works<\/strong><\/p>\n<p>The vulnerability lies in user-defined <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-32577-php-remote-file-inclusion-vulnerability-in-hakeemnala-build-app-online\/\"  data-wpil-monitor-id=\"32333\">OX<\/a>MF templates that can tap into a limited part of the internal OX App Suite Java API. The existing switch that should disable these templates by default is not effective, allowing <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-5881-unauthorized-access-vulnerability-in-the-genie-company-aladdin-connect\/\"  data-wpil-monitor-id=\"33991\">unauthorized users to access<\/a> and modify the application state. This includes objects related to other users and contexts. It&#8217;s important to note that the vulnerability can be exploited remotely, without any <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-31524-privilege-escalation-vulnerability-in-notfound-wp-user-profiles\/\"  data-wpil-monitor-id=\"32375\">user interaction or special privileges<\/a>.<\/p>\n<p><strong>Conceptual Example Code<\/strong><\/p><div id=\"ameeb-1896197727\" class=\"ameeb-content ameeb-entity-placement\"><div class=\"poptin-embedded\" data-id=\"f6b387694f681\"><\/div>\r\n\r\n\r\n\r\n\r\n\r\n<\/div>\n<p>Although no public exploits are known at this time, the following is a conceptual example of how this <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-50123-exploitable-vulnerability-in-hozard-alarm-system-sms-authentication\/\"  data-wpil-monitor-id=\"38267\">vulnerability might be exploited<\/a>:<\/p>\n<pre><code class=\"\" data-line=\"\">\/\/ Pseudo code to demonstrate exploitation of CVE-2023-29051\nOXMF_Template template = new OXMF_Template(&quot;malicious_template&quot;);\ntemplate.setAccessible(true); \/\/ Bypasses the switch that should disable the template\n\/\/ Accesses the internal OX App Suite Java API\nInternalAPI api = template.getInternalAPI();\n\/\/ Modifies the application state\napi.modifyApplicationState(&quot;target_user&quot;, &quot;malicious_modifications&quot;);<\/code><\/pre>\n<p>The <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-32958-critical-adept-language-vulnerability-allowing-malicious-code-execution\/\"  data-wpil-monitor-id=\"38266\">code above represents a hypothetical exploit where a malicious<\/a> OXMF template is created, made accessible, and then used to access the internal API and modify the application state for a target user.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Overview The vulnerability CVE-2023-29051, recently discovered in the OX App Suite, allows unauthorized users to access and modify the application state, including objects related to other users and contexts. This is due to an ineffective switch that should disable user-defined OXMF templates by default. The OX App Suite is widely used for email, collaboration, and [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-27912","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/27912","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/comments?post=27912"}],"version-history":[{"count":6,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/27912\/revisions"}],"predecessor-version":[{"id":33751,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/27912\/revisions\/33751"}],"wp:attachment":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/media?parent=27912"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/categories?post=27912"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/tags?post=27912"},{"taxonomy":"vendor","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/vendor?post=27912"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/product?post=27912"},{"taxonomy":"attack_vector","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/attack_vector?post=27912"},{"taxonomy":"asset_type","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/asset_type?post=27912"},{"taxonomy":"severity","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/severity?post=27912"},{"taxonomy":"exploit_status","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/exploit_status?post=27912"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}