Cisco Enterprise NFV Infrastructure Software Cross-Site Scripting Vulnerability

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS). The issue stems from improper input validation of log file content, allowing an authenticated attacker to inject malicious script into log files. When a user views the affected log file through the web interface, the script executes. Versions earlier than Release 4.4.1 are affected [1].

Exploitation

An attacker must have authenticated access to the NFVIS device and the ability to modify log files (e.g., via administrative functions). The attacker injects malicious script into a log file and then tricks a user (often another administrator) into viewing that log file via the web-based management interface. No additional user interaction beyond viewing the log is required for script execution [1].

Impact

Successful exploitation allows the attacker to execute arbitrary script code in the context of the affected web interface, potentially accessing sensitive browser-based information such as session tokens or cookies. The attack is confined to the browser session of the user viewing the log file and does not directly compromise the underlying NFVIS system [1].

Mitigation

Cisco has released software updates to address this vulnerability. The fixed version is NFVIS Release 4.4.1. No workarounds are available. Users should upgrade to the latest release. As of publication, no exploitation in the wild has been reported [1].