CVE-2021-36760 in Identity Server
Summary
by MITRE • 12/08/2021
In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code will be executed. (recoverpassword.do also has an open redirect issue for a similar reason.)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 12/10/2021
The vulnerability identified as CVE-2021-36760 affects WSO2 Identity Server version 5.7.0, specifically within the accountrecoveryendpoint/recoverpassword.do component. This represents a critical security flaw that enables attackers to execute malicious JavaScript code through DOM-based cross-site scripting techniques. The vulnerability manifests when the callback parameter in the URL is manipulated, allowing adversaries to inject malicious scripts that will execute once the password recovery process is completed. The attack vector leverages the browser's Document Object Model to inject malicious code that persists in the application's response handling mechanism.
The technical implementation of this vulnerability stems from insufficient input validation and sanitization of the callback parameter within the password recovery endpoint. When users navigate to the recovery page with a maliciously crafted callback URL, the application fails to properly escape or validate the parameter before incorporating it into the JavaScript execution context. This creates a persistent XSS vulnerability where the malicious code becomes part of the page's DOM and executes in the victim's browser context. The flaw is particularly dangerous because it occurs during a legitimate user interaction - the password recovery process - making it difficult to distinguish between benign and malicious requests.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable attackers to steal user sessions, credentials, or perform unauthorized actions on behalf of victims. The open redirect issue present in the same endpoint compounds the risk, allowing attackers to redirect users to malicious sites while the XSS payload executes. This dual vulnerability creates a sophisticated attack scenario where adversaries can both execute malicious code and redirect users to phishing sites, potentially leading to credential theft, session hijacking, or further exploitation of the compromised accounts. The vulnerability affects all users of WSO2 Identity Server 5.7.0 who interact with the password recovery functionality.
Security mitigations for this vulnerability should focus on implementing comprehensive input validation and output encoding for all parameters used in the password recovery endpoint. The recommended approach includes sanitizing all callback parameters using proper HTML escaping techniques and implementing strict validation of URL formats to prevent malicious redirection. Organizations should also consider implementing Content Security Policy headers to limit script execution capabilities and employ web application firewalls to detect and block suspicious parameter values. According to CWE guidelines, this vulnerability maps to CWE-79 (Cross-site Scripting) and CWE-601 (Open Redirect), while the ATT&CK framework would categorize this under T1531 (Account Access Removal) and T1071.3 (Application Layer Protocol: Web Protocols) for the exploitation techniques involved. Patching the WSO2 Identity Server to a version that addresses this vulnerability is the most effective long-term solution, as the vendor has released updates that properly sanitize input parameters and prevent DOM-based XSS attacks in the recovery endpoint.