CVE-2021-39054

Vulnerability

IBM Spectrum Copy Data Management versions 2.2.13 and earlier contain a clickjacking vulnerability [1]. The issue allows a remote attacker to hijack the clicking action of a victim by embedding the application's UI in a malicious web page, tricking the user into performing unintended actions within the application's security context.

Exploitation

To exploit this vulnerability, an attacker must persuade a victim to visit a malicious website [1]. No authentication or special network position is required beyond the victim's browser. The attacker crafts a transparent overlay or iframe that captures clicks, which are then sent to the IBM Spectrum Copy Data Management interface while the user believes they are interacting with the attacker's site.

Impact

A successful clickjacking attack enables the attacker to hijack the victim's click actions within the Spectrum Copy Data Management application [1]. This could lead to unauthorized actions being performed by the victim's session, such as configuration changes, data access, or further exploitation, depending on the victim's privileges and the application's functionality.

Mitigation

IBM has addressed this vulnerability in a security update. Users should upgrade to IBM Spectrum Copy Data Management version 2.2.14 or later as listed in the vendor advisory [1]. No workarounds have been published by IBM.