AI analysis
Apache Sling XSS, the anti-XSS filtering library used by Sling-based Java applications (including Adobe Experience Manager), contains an improper input neutralization flaw (CWE-79) in XSSImpl prior to version 2.4.12. The flaw includes multiple 'raw-string break-outs', meaning attacker-controlled content can escape the library's sanitization, plus a regular-expression denial-of-service (ReDoS) issue in the same component. When an application uses the library to filter untrusted input that is later rendered in a generated web page, an attacker who can get crafted content stored or reflected and viewed by a victim can execute script in the victim's browser, potentially hijacking their session or performing actions on their behalf. The ReDoS component can additionally be triggered to hang processing threads with pathological input. The fix is upgrading to Apache Sling XSS 2.4.12; there is no known public proof of concept and no evidence of exploitation in the wild.
What to do: Upgrade the Apache Sling XSS bundle (org.apache.sling.xss) to version 2.4.12, deploying via the OSGi console or a dependency bump, and if you run Adobe Experience Manager apply the corresponding bundle update when Adobe publishes it. Audit applications that rely on XSSImpl for sanitization and review rendered user-supplied content for any injected scripts that may have bypassed the old filter. Until patched, limit input sizes and use WAF rules to mitigate both the stored/reflected XSS risk and the ReDoS condition in XSSImpl.
Affected
| Apache Sling XSS | before 2.4.12 (< 2.4.12) |
Estimated exposure
moderateon the order of a few thousand internet-exposed Sling/AEM-based servers, plus an unknown number of internal deployments — Apache Sling is an enterprise Java web framework best known as the foundation of Adobe Experience Manager; public internet scans typically show low-thousands of exposed Sling/AEM endpoints, with the majority of instances running inside…
Description
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.