CVE-2024-5139: Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection
The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint.
Successful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the httpOnly flag on session-related cookies, session hijacking is not possible.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker must cause a user to submit crafted input to the Authentication Endpoint. Exploitation requires user interaction, as reflected by the UI:R attack vector.
What can an attacker do after successful exploitation?
The attacker can execute malicious JavaScript in the affected browser context to redirect the user to a malicious site, alter the page interface, or extract sensitive information available to the browser.
Can this vulnerability be used to hijack user sessions?
No. Session-related cookies are protected with the httpOnly flag, so malicious JavaScript cannot access them for session hijacking.