Snowstorm
Monthly
Reflected XSS in Snowstorm's Web Route redirection endpoint allows remote unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by luring them to a crafted malicious link. The vulnerability resided in a Spring Boot REST controller's error-handling path, where attacker-controlled input in the `uri` parameter was reflected verbatim in a 400 Bad Request response body; when combined with an `Accept: text/html` request header, Spring's content negotiation rendered the response as HTML, enabling script injection. No CISA KEV listing or public exploit code was identified at time of analysis; two upstream patch commits and a CISA advisory reference confirm vendor acknowledgment and fix availability in versions 10.12.2 and 10.9.3.
Reflected XSS in Snowstorm's Web Route redirection endpoint allows remote unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by luring them to a crafted malicious link. The vulnerability resided in a Spring Boot REST controller's error-handling path, where attacker-controlled input in the `uri` parameter was reflected verbatim in a 400 Bad Request response body; when combined with an `Accept: text/html` request header, Spring's content negotiation rendered the response as HTML, enabling script injection. No CISA KEV listing or public exploit code was identified at time of analysis; two upstream patch commits and a CISA advisory reference confirm vendor acknowledgment and fix availability in versions 10.12.2 and 10.9.3.