Description

A reflected cross-site scripting (XSS) vulnerability in the login/SSO error page of INFINITT ULite 5.0.2.1_BN48_20260528 and earlier allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser of a victim who opens a crafted link. An unsanitized request parameter is reflected without output encoding. Fixed in ULite 5.0.2.1 BN50.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-11-06T09:17:01.557Z",
  "pubdate": "2026-11-06T09:17:01.557Z",
  "executiveSummary": "This vulnerability is identified as a reflected cross-site scripting (XSS) flaw affecting the login and Single Sign-On (SSO) error pages of INFINITT ULite versions 5.0.2.1_BN48_20260528 and earlier.\nThe security vulnerability originates from the application's failure to perform adequate input validation and output encoding on user-supplied request parameters processed during error handling.\nSuccessful exploitation allows an unauthenticated remote attacker to execute arbitrary JavaScript within the context of the victim's browser session. This can lead to unauthorized actions performed on behalf of the user, session hijacking, credential theft, or the redirection of users to malicious third-party domains.\nThe attack is triggered when an unsuspecting user interacts with a specially crafted, malicious link prepared by the attacker. No prior authentication is required to initiate the attack, making it a significant risk to remote users interacting with the web interface. The issue has been addressed in version 5.0.2.1 BN50, which implements the necessary sanitization routines to prevent script injection.",
  "technicalDetails": "The root cause of this vulnerability is the improper handling of user-controlled input within the application's error reporting logic during the authentication or SSO process. Specifically, the web application reflects unsanitized request parameters directly into the HTML response document without applying context-aware output encoding.\nWhen a user navigates to the login or SSO page with a manipulated URL parameter, the application embeds the malicious input directly into the rendered page structure. Because the server-side logic fails to strip or escape characters such as <, >, \", or ', an attacker can inject arbitrary HTML or JavaScript tags into the DOM (Document Object Model).\nThe exploitation flow proceeds as follows: 1) An attacker crafts a URL containing a malicious JavaScript payload injected into a vulnerable request parameter. 2) The attacker distributes this link to a targeted user through social engineering, phishing, or other distribution channels. 3) Upon the user clicking the link, the victim's browser sends the request to the INFINITT ULite server. 4) The server processes the request and reflects the malicious script back to the user's browser in the error page response. 5) The victim's browser interprets the injected script as legitimate content, executing the code in the security context of the vulnerable application.\nBecause the execution occurs within the victim's browser session, the malicious code inherits the victim's session cookies and authentication tokens. An attacker can leverage this to steal session identifiers, perform unauthorized administrative or operational tasks, or perform cross-site request forgery (CSRF) by proxying requests through the authenticated user. Furthermore, the attacker can manipulate the user's interface to deceive them into submitting credentials or sensitive data to a malicious server. The vulnerability is persistent across all instances of the affected versions, specifically encompassing all builds of INFINITT ULite up to and including 5.0.2.1_BN48_20260528, where no mitigations against script injection were present in the error handling framework."
}