Cisco Enterprise NFV Infrastructure Software Cross-site Scripting Vulnerability

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the web portal framework of Cisco Enterprise NFV Infrastructure Software (NFVIS). The flaw is due to improper input validation of log file content stored on the device. An authenticated attacker can inject malicious script code into a log file, which is later rendered in the web interface without sanitization. Affected versions are those earlier than NFVIS Release 3.11.1 [1].

Exploitation

An attacker must have authenticated access to the NFVIS device and the ability to modify log files (e.g., via the CLI or API). The attacker writes malicious JavaScript into a log entry. To trigger the XSS, the attacker must then convince a user (typically another administrator) to view the modified log file through the web-based interface. No additional privileges or user interaction beyond viewing the log are required [1].

Impact

Successful exploitation allows the attacker to execute arbitrary script code in the context of the affected web interface. This can lead to disclosure of sensitive browser-based information (e.g., session tokens, cookies) or actions performed on behalf of the victim user. The attacker gains the ability to perform actions with the privileges of the user viewing the log, potentially compromising the entire NFVIS management session [1].

Mitigation

Cisco has released software updates to address this vulnerability. The fix is included in NFVIS Release 3.11.1 and later. No workarounds are available. Users should upgrade to a fixed release as soon as possible [1].