Reflected Cross-Site Scripting in SNOMED International Snowstorm

Executive Summary

This is a reflected Cross-Site Scripting (XSS) vulnerability in SNOMED International Snowstorm's web route redirection functionality. An attacker can craft a malicious link that injects arbitrary JavaScript. When a user clicks the link, the script executes in their browser due to improper error response handling that allowed HTML content type manipulation.

Useful 0 Not Useful 0

Detection Guidance

To detect this reflected XSS vulnerability, monitor web traffic for requests to the /web-route endpoint with manipulated Accept headers forcing text/html responses. Check for unusual JavaScript execution in responses or logs indicating error messages returned as plain text.

Useful 0 Not Useful 0

Impact Analysis

If you click a malicious link, the injected JavaScript could steal session cookies, perform actions on your behalf, or redirect you to phishing sites. This could lead to account compromise or unauthorized data access if you interact with the affected system.

Useful 0 Not Useful 0

Compliance Impact

This XSS vulnerability could expose sensitive data processed by the system, potentially violating GDPR's data protection requirements or HIPAA's security rules for protected health information. Organizations using affected versions may face compliance violations if user data is compromised through this attack vector.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Snowstorm to version 10.12.2 or 10.9.3 or later to apply the security fix. Ensure error responses are properly formatted as JSON/XML and not returned as plain text. Review and remove any direct error handling in web route controllers.

Useful 0 Not Useful 0