CVE-2018-17150

Vulnerability

InterSystems Cache versions 2017.2.2.865.0 and 2018.1.2 are affected by both stored and reflected cross-site scripting (XSS) vulnerabilities [1]. The reflected XSS can be triggered by crafting a malicious link that, when clicked by an authenticated user, executes arbitrary JavaScript in the context of the user's session. The stored XSS can be exploited by a low-privilege user to inject malicious scripts that affect administrative users.

Exploitation

An attacker can exploit reflected XSS by sending a crafted URL to an authenticated user, including administrators, without requiring authentication [1]. For stored XSS, a low-privilege user can inject malicious script into application data that is later rendered to higher-privilege users, such as administrators. No special network position is required; the attack can be launched remotely.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript within the victim's browser, potentially leading to privilege escalation, session hijacking, or theft of sensitive data [1]. The CVSS score is 6.5 (Medium) with a vector indicating network access, low complexity, no privileges required, user interaction required, and changed scope [1].

Mitigation

InterSystems released version 2018.1.2 on March 14, 2019, which remediates some XSS instances [1]. However, remaining XSS issues persist in that version as noted in Appendix C. Users are advised to update to the latest version, disable the samples application, and avoid using Private Pages functionality as an authorization mechanism [1].