CVE-2023-38826

Vulnerability

A reflected Cross-Site Scripting (XSS) vulnerability exists in the handlewpesearchform.do endpoint of Follet Learning Solutions Destiny versions up to 20.0_1U. The searchString parameter is not properly sanitized, allowing an attacker to inject arbitrary HTML and JavaScript code into the page returned by the server. The vulnerable request is a GET to /cataloging/servlet/handlewpesearchform.do with the malicious payload in the searchString parameter [1].

Exploitation

An attacker must first ensure the victim's session has the proper school ID set in a cookie, which can be achieved through social engineering to have the victim click on the correct school beforehand [1]. The attacker then crafts a URL with the XSS payload encoded in the searchString parameter, such as searchString=twode%3c%2ftitle%3e%3cscript%3ealert("Reflected XSS :)")%3c%2fscript%3eaaaaa, and tricks the victim into visiting it. The injected script can execute arbitrary JavaScript; for example, a proof-of-concept payload fetches a remote login form and overlays it on the page to steal credentials [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session, leading to potential theft of sensitive data such as login credentials, session tokens, or school-related information. The attack is reflected (non-persistent) but can be chained with social engineering to achieve account takeover or data exfiltration within the affected Destiny environment [1].

Mitigation

As of the available references, no patch or workaround is disclosed for this vulnerability. The vendor, Follett Learning Solutions, has released versions beyond 20.0_1U, but it is unclear if those versions include a fix. Users should apply input validation and output encoding on the searchString parameter as a recommended defense until an official update is confirmed. The CVE is not listed on CISA's Known Exploited Vulnerabilities catalog [1].