EUVD-2025-209699
GHSA-rmc9-985c-h9wg
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L
Lifecycle Timeline
1DescriptionNVD
HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers to inject malicious scripts increasing the risk of cross-site scripting (XSS) and potential exposure of sensitive information.
AnalysisAI
HCL BigFix Service Management (SM) contains a Content Security Policy (CSP) header misconfiguration that enables cross-site scripting (XSS) attacks. Authenticated users with low privileges can inject malicious scripts by exploiting insufficient CSP directives, potentially exposing sensitive information or hijacking user sessions. The vulnerability requires user interaction (UI:R) and operates in a non-global scope, limiting but not eliminating real-world risk.
Technical ContextAI
The vulnerability stems from inadequate Content Security Policy (CSP) header configuration (CWE-358: Improperly Restricted Operations within Bounds of a Buffer), a web security control designed to prevent inline script injection and restrict script sources. BigFix Service Management, an enterprise IT service management platform typically deployed in security-sensitive environments, relies on CSP headers to defend against XSS attacks. When CSP headers are misconfigured-such as allowing 'unsafe-inline', overly permissive sources, or missing directives-attackers can inject JavaScript into the application context. The CPE indicates all versions of HCL BigFix Service Management (SM) are potentially affected, suggesting the misconfiguration is present across the product line until a patched version is released.
RemediationAI
Immediate action requires applying the security patch from HCL Software. Users should review HCL support article KB0128144 for the specific patched version applicable to their deployment. The primary fix involves HCL updating CSP headers to enforce strict directives, eliminating 'unsafe-inline' script sources and limiting script-src to whitelisted, non-external origins. If an immediate patch is unavailable, implement compensating controls: configure a Web Application Firewall (WAF) with rules to detect and block JavaScript injection patterns in request payloads and enforce Content-Security-Policy headers at the reverse proxy level with directives such as 'script-src self' and 'default-src self'. These controls reduce attack surface but may impact legitimate functionality if the application relies on inline scripts; coordinate with HCL support before deployment. Restrict access to BigFix Service Management administrative and authoring interfaces to trusted networks and apply rate-limiting and request validation on all user input fields.
Share
External POC / Exploit Code
Leaving vuln.today