EUVD-2025-210724
GHSA-9h23-c6rx-c2j3
Severity by source
AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Web-based JS hijacking is network-agnostic (AV:N overrides vendor AV:A); impact is confidentiality-only, not integrity, so I:N.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page (JavaScript hijacking) under certain conditions.
AnalysisAI
JavaScript hijacking in HCL AION v2.1.0 exposes sensitive data from dynamic JavaScript responses to attacker-controlled pages under specific network and user interaction conditions. The vulnerability arises because JSON or JavaScript-formatted responses from AION can be referenced cross-origin by a malicious page, enabling data capture via classic JS hijacking techniques. No public exploit has been identified at time of analysis, and the low CVSS score of 3.7 reflects high attack complexity and constrained impact scope.
Technical ContextAI
HCL AION (CPE: cpe:2.3:a:hcl_software:aion:*:*:*:*:*:*:*:*) is an AI-driven process automation platform by HCL Software. The root cause is classified as CWE-352 (Cross-Site Request Forgery), but the mechanism described is the related JavaScript hijacking pattern - a technique where a malicious page includes a script tag referencing an authenticated endpoint that returns JavaScript or JSON array data. Because browsers historically execute such responses in the context of the including page, an attacker-controlled script override (e.g., redefining Array constructors or using getter traps) can intercept the response data before it is consumed by the legitimate application. This attack class predates modern CORS controls and can bypass them when endpoints are served without strict content-type enforcement or missing CORS headers. The adjacent-network vector (AV:A) assigned by HCL suggests the exploitation path may depend on network proximity, though web-based JS hijacking typically does not require adjacency.
RemediationAI
The primary remediation is to apply the vendor-supplied patch or upgrade as documented in HCL's advisory KB0133084 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133084. An exact fixed version number is not independently confirmed from the available data - contact HCL support to obtain the specific patched release. As a compensating control, administrators should ensure AION endpoints that return JavaScript or JSON responses are served with strict Content-Type headers (application/json rather than application/javascript or text/javascript) and include appropriate CORS policy headers restricting cross-origin access to trusted origins only. Additionally, enforcing CSRF tokens on authenticated API endpoints that return dynamic data would prevent the cross-site request that enables the hijacking. Restricting access to AION to internal network segments (if operationally feasible) would eliminate the adjacent-network attack surface implied by the AV:A vector. Note that CORS header changes may require application-level configuration and could affect legitimate integrations.
Content security policy bypass in HCL AION v2.0 enables inline script injection, allowing remote attackers to modify web
Session hijacking vulnerability in HCL AION 2.0 due to missing 'Secure' flag on SSL session cookies allows unauthenticat
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing
Insufficient anti-automation controls on certain HCL AION v2.1.0 endpoints allow scripted or automated requests to bypas
HCL AION contains a container base image authentication vulnerability where container images are not properly verified b
Aion versions up to 2.0 is affected by incorrect permission assignment for critical resource (CVSS 5.5).
Script allowlist bypass in HCL AION 2.0 allows unauthorized script execution through a misconfigured Content-Security-Po
HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that coul
HCL AION fails to enforce encryption for certain data transmissions or operations, potentially exposing sensitive inform
HCL AION allows exposure of sensitive information through out-of-band interactions triggered by certain operations, affe
HCL AION exposes sensitive backend infrastructure details through an information disclosure vulnerability affecting auth
A security vulnerability in HCL AION (CVSS 4.7). Remediation should follow standard vulnerability management procedures.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today