Group-Office Stored Blind Cross-Site Scripting Vulnerability in User Profile Name Field

A stored and blind cross-site scripting vulnerability has been identified in Group-Office versions through 6.8.120 and 25.0.23. The issue resides in the Name Field of the user profile, where an attacker can inject a JavaScript payload. This payload is executed when the malicious user is added to another user's Synchronization Address books. The vulnerability has been patched in Group-Office versions 6.8.123 and 25.0.27.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the profile. This could lead to unauthorized fetch requests, data theft, session hijacking, or account manipulation.

Reproduction

To reproduce this vulnerability, log in as an admin and create two users. Log in as the first user and inject an XSS payload into the Name field. Then, log in as the second user and add the first user to the address book, which will trigger the execution of the injected script.

Remediation

Users are advised to update to Group-Office versions 6.8.123 or 25.0.27.