The affected asset is anonymised at the researcher's request.
A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Sony MEP application's login functionality. The redirect parameter within the login URL fails to properly sanitize user-supplied input, allowing attackers to inject and execute malicious JavaScript code. This vulnerability can be exploited to execute arbitrary scripts in the context of an authenticated administrator's browser session, potentially leading to session hijacking, credential theft, and unauthorized actions within the application. Affected URL https://mep.csl.sony.co.jp/_app/login/?redirect=javascript:alert() Technical Details Parameter Affected: redirect Vulnerability Type: Reflected Cross-Site Scripting (XSS) Exploit Vector: The redirect parameter accepts a javascript: URI scheme without proper validation or encoding, enabling the execution of arbitrary JavaScript code. Vulnerability Mechanics: Malicious URL Construction: An attacker crafts a URL containing a malicious JavaScript payload within the redirect parameter. Example: https://mep.csl.sony.co.jp/_app/login/?redirect=javascript:alert('XSS') Distribution of Malicious URL: The attacker disseminates the crafted URL to target users, particularly administrators with elevated privileges. Execution Upon Authentication: When an administrator accesses the URL and successfully logs in, the application processes the redirect parameter without adequate sanitization, executing the embedded JavaScript payload within the administrator's browser context. Potential Exploits: Session Hijacking: Stealing session tokens to impersonate the administrator. Credential Theft: Capturing login credentials or sensitive data entered by the administrator. Unauthorized Actions: Performing actions on behalf of the administrator without their knowledge. Defacement: Altering the application's appearance to mislead or deceive users. Steps to Reproduce Craft the Malicious URL: https://mep.csl.sony.co.jp/_app/login/?redirect=javascript:alert('XSS') Access the URL: Open the crafted URL in a web browser. Login Process: Proceed to log in with valid administrator credentials. Observe XSS Execution: Upon successful authentication, a JavaScript alert box displaying "XSS" is triggered automatically, demonstrating the execution of the injected script. Impact Session Hijacking: Attackers can steal session cookies, allowing unauthorized access to administrative accounts. Credential Theft: Malicious scripts can capture and transmit login credentials entered by administrators. Data Manipulation: Unauthorized modification, deletion, or exfiltration of sensitive data within the application. Privilege Escalation: Execution of administrative actions without the administrator's consent. Reputation Damage: Exploitation of this vulnerability can erode user trust and damage the organization's reputation. Further Exploitation: Compromised administrative accounts can be leveraged to conduct additional attacks within the organization's infrastructure.