CVE-2021-31643

Vulnerability

An XSS vulnerability exists in the if.cgi component of several CHIYU Technology IoT devices, including SEMAC, Biosense, BF-630, BF-631, and Webpass, due to a lack of sanitization of the username parameter [1]. This allows an attacker to inject arbitrary JavaScript or HTML into the web interface. The affected firmware versions are not explicitly listed, but the vulnerability is present in devices running older firmware [2].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL containing a payload in the username parameter of if.cgi and tricking a victim into clicking it. No authentication is required to trigger the XSS, as the parameter is processed without proper validation. The victim must be logged into the device's web interface for the script to execute in their session context [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, credential theft, defacement, or redirection to malicious sites. The attack operates within the security context of the web application, enabling the attacker to perform actions on behalf of the victim [1].

Mitigation

CHIYU Technology has released firmware updates to address this vulnerability; users should update their devices to the latest firmware version available from the vendor's support page [2]. If updating is not immediately possible, restrict network access to the device's web interface to trusted users only. No workaround is provided in the available references [1][2].