CVE-2021-45223

Vulnerability

COINS Construction Cloud version 11.12 contains an improper input neutralization vulnerability (CWE-707) in the handling of the MainArea parameter in HTTP requests. A logged-in user can trigger a server crash by sending a specially crafted request with a malformed MainArea value, as demonstrated in the proof-of-concept URL provided in the advisory [1]. The vulnerability affects the wou005.p endpoint and related components [1][2].

Exploitation

An attacker must have a valid user account on the COINS Construction Cloud instance. After logging in, the attacker sends an HTTP GET request to a URL such as https://[target].coinscloud.com/env/[environment]/wou005.p?kco=24&pvCILevel=2&pvCISibling=24&TopMenu=%25WHOME&MainArea=a'a%5c'b%22c%3e%3f%3e%25%7d%7d%25%25%3ec%3c[[%3f$%7b%7b%25%7d%7dcake%5c&FrameBanner=N&frameID=1&program=wou005.p&updateContextHSA=ActivityWB&hs_actionRowid=?&info=cosval.activities&pvFrame=F%2C1664%2C196 [1]. The malformed MainArea parameter causes the server to become unresponsive within seconds [1]. No additional privileges or user interaction beyond login are required.

Impact

Successful exploitation results in a complete denial of service (DoS) of the COINS Construction Cloud server. The server becomes unresponsive, preventing all users from accessing the application [1]. The attack does not lead to data disclosure, modification, or code execution; the impact is limited to availability loss.

Mitigation

As of the public disclosure date (2022-01-13), no official fix or patch has been released by the vendor [1]. The manufacturer was notified on 2021-11-02 but did not respond, and the solution status remains open [1]. No workarounds are documented in the available references. Users should monitor vendor communications for updates and consider implementing network-level controls to restrict access to the affected endpoints if possible.