Adobe Consulting Services Reflected Cross-Site Scripting Arbitrary Code Execution

Vulnerability

ACS Commons version 5.1.x (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in the /apps/acs-commons/content/page-compare.html endpoint. The a and b GET parameters accept user input that is not validated or sanitized before being reflected in the response [1][3]. This allows an attacker to inject arbitrary JavaScript into the page.

Exploitation

An attacker must craft a malicious link containing JavaScript payloads in the a or b parameters and send it to a user who has access to an AEM Author instance. The victim must click the link, which triggers the reflected XSS. No authentication is required beyond the victim's existing session, but user interaction is necessary for successful exploitation [1][3].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to information disclosure, session hijacking, or other actions performed on behalf of the victim within the AEM Author environment [1][3].

Mitigation

This issue has been resolved in ACS Commons version 5.2.0 [3]. Users should upgrade to 5.2.0 or later. No workarounds are available [3]. If upgrading is not immediately possible, restrict access to the page-compare endpoint or apply a web application firewall rule to sanitize the a and b parameters.