CVE-2021-45224

Vulnerability

COINS Construction Cloud version 11.12 suffers from improper neutralization of special elements used in a command (CWE-77). In several views, such as the "Browse Documents" page, JavaScript code is passed via the postCheckRowids and afterPost HTTP GET URL parameters without sanitization. An attacker can replace the original JavaScript with arbitrary code, leading to reflected cross-site scripting (XSS) [1].

Exploitation

An attacker crafts a malicious URL containing JavaScript payloads in either the postCheckRowids or afterPost parameter. The victim must be logged into the application and click the link. When the page loads, the injected JavaScript executes in the context of the victim's session [1][2]. No additional authentication or high privileges are required on the attacker's part.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. Because the XSS is reflected, the attacker can target specific users and potentially escalate privileges by stealing cookies or performing actions on behalf of the victim [1][2].

Mitigation

As of the publication date, no fix has been released by the manufacturer, COINS; the solution status remains open [1]. The vendor was notified on 2021-11-02 but provided no response, and it is unclear whether later versions address the issue [2]. Until a patch is available, organizations should restrict access to the application, use web application firewalls to filter malicious parameters, and educate users not to click untrusted links while authenticated.