CVE-2026-113810 in Network Security
Summary
by MITRE • 10/20/2026
A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.
Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/20/2026
The identified security flaw represents a classic instance of Stored Cross-Site Scripting, commonly categorized under CWE-79 in industry standard vulnerability classifications. This specific implementation occurs within an SNS enrollment portal that utilizes a captive portal mechanism for user authentication and certificate issuance workflows. The core technical deficiency lies in the insufficient sanitization or validation of input data provided during the certificate creation request process. When an attacker submits malicious script content as part of this request, the system fails to adequately filter out executable code before persisting it into its backend storage systems. Consequently, the injected payload becomes a permanent fixture within the application's database rather than being transiently processed and discarded.
The operational impact of this vulnerability is distinct due to its stored nature combined with a specific trigger condition. Unlike reflected XSS where malicious links must be clicked by victims immediately, this flaw requires an administrative action for exploitation. The attacker injects the payload during the user certificate creation phase, embedding it within data that appears legitimate or benign at first glance. However, when a system administrator subsequently accesses the portal to validate, review, or approve these pending requests, their browser executes the malicious script in the context of the admin session. This scenario is particularly dangerous because administrators typically possess elevated privileges and access sensitive internal resources. The execution occurs within the trusted domain of the enrollment portal, allowing the attacker to bypass same-origin policy restrictions that would otherwise limit the scope of typical client-side attacks.
From a threat modeling perspective aligned with the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Client-Side Scripting Injection and potentially Credential Access if session cookies are stolen via document.cookie access within the admin context. The attacker can harvest administrative credentials, hijack active sessions to perform unauthorized actions such as issuing fraudulent certificates or modifying user permissions, and potentially pivot further into the internal network by using the compromised administrator account as a foothold. Because the payload is stored server-side, it remains persistent until manually removed from the database, meaning every subsequent admin visit to that specific validation screen poses a risk of compromise without any additional effort required from the attacker after the initial injection.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Immediately, all instances of malicious payloads stored in the database related to certificate requests should be purged or sanitized. More critically, developers must implement robust input validation on the server side for all fields involved in the certificate creation process, ensuring that only expected character sets are accepted. Output encoding is equally vital; any data rendered back into HTML responses destined for administrative interfaces must undergo strict context-aware escaping to prevent browser interpretation of script tags or event handlers. Adopting a Content Security Policy with nonces or hashes can further mitigate impact by restricting the execution environment even if injection occurs. Regular security code reviews focusing on web application firewall rules and parameterized query usage will help prevent similar vulnerabilities in future development cycles, ensuring that user-supplied data is never treated as executable code regardless of its intended purpose within the enrollment workflow.