CVE-2021-32828: Nuxeo Platform OAuth Reflected XSS leading to RCE
Summary
CVE-2021-32828: Nuxeo vulnerable to Reflected Cross-Site Scripting leading to Remote Code Execution. Affects org.nuxeo.ecm.platform:nuxeo-platform-oauth versions < 10.10. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Nuxeo Platform is an open source content management platform used for building business applications. It provides various features for managing and organizing content, including an OAuth2 REST API for authentication and authorization. The vulnerable component in this case is the 'nuxeo-platform-oauth' package.
Vulnerability Detail
The 'oauth2' REST API in Nuxeo Platform version 11.5.109 is susceptible to Reflected Cross-Site Scripting (XSS) attacks. This means that an attacker can inject malicious scripts into the application, which will be executed in the context of the victim's browser. This XSS vulnerability can be further exploited to achieve Remote Code Execution (RCE) by leveraging the automation API.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is recommended to implement input sanitization and output encoding to prevent the execution of malicious scripts. This can be achieved by using appropriate security libraries and frameworks that provide protection against XSS attacks. Here is an example of how to sanitize user input in Java using the OWASP Java Encoder library:
import org.owasp.encoder.Encode;
String sanitizedInput = Encode.forHtml(userInput);
By encoding user input before displaying it in HTML, you can prevent the execution of injected scripts.
Conclusion
In conclusion, the Nuxeo Platform version 11.5.109 is vulnerable to Reflected Cross-Site Scripting (XSS) attacks in the 'oauth2' REST API. This vulnerability can be escalated to Remote Code Execution (RCE) by leveraging the automation API. To mitigate this risk, it is crucial to upgrade to a non-affected version of Nuxeo Platform and implement secure coding practices. For more information and assistance, please reach out to DevNack.com.
See every vulnerability recorded for org.nuxeo.ecm.platform:nuxeo-platform-oauth →
FAQ
The vulnerability allows an attacker to inject and execute arbitrary scripts in the context of a victim's browser. This can lead to various malicious activities, such as stealing sensitive information, performing unauthorized actions on behalf of the victim, or even compromising the entire system by achieving remote code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the 'pom.xml' file of your project.
Yes, the CVSS score for this vulnerability is 5.4, indicating a moderate severity level.
At the time of this report, there are no known public exploits available for this vulnerability. However, it is important to address the vulnerability promptly to prevent any potential exploitation.
You can find more information about this vulnerability, including the CVE identifier (CVE-2021-32828), on the Vulert platform at Vulert Scanner. For further support and assistance in vulnerability remediation, you can contact info@devnack.com.
