Description

HCL AION is affected by an open redirect vulnerability in the navigation bar of the GenAI web interface (Navbar component). The switch-version action redirected the browser to a dynamically constructed URL (window origin + '/workspace') without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-11-06T14:17:11.533Z",
  "pubdate": "2026-11-06T14:17:11.533Z",
  "executiveSummary": "HCL AION contains an open redirect vulnerability located within the 'switch-version' action of the GenAI web interface's Navbar component.\nThis vulnerability stems from the application's failure to perform adequate input validation or origin verification when constructing redirect URLs.\nBy manipulating the destination parameter, an unauthenticated or authenticated attacker can force the web application to redirect users to arbitrary, malicious, or external domains.\nThe primary risk implications involve phishing campaigns, where attackers leverage the trust associated with the legitimate HCL AION domain to deceive users into visiting credential-harvesting sites or malicious payloads.\nThe vulnerability does not require complex prerequisites for exploitation; it relies on the application's reflexive handling of user-supplied input to generate navigation logic.\nSuccessful exploitation allows attackers to bypass security awareness filters by redirecting victims from a trusted origin to a secondary location under the attacker's control.",
  "technicalDetails": "The vulnerability resides within the frontend Navbar component of the HCL AION GenAI web interface, specifically triggered by the 'switch-version' navigation action.\nThe root cause is a lack of server-side or client-side validation for the redirection target during the dynamic construction of URLs. The application logic concatenates the 'window origin' with a hardcoded path ('/workspace') but fails to enforce a strict allowlist or validate the integrity of the redirect parameter.\nIn a typical attack flow, an attacker crafts a malicious URL containing a crafted 'switch-version' request. When a user clicks the link or executes the action, the JavaScript logic in the Navbar component processes the request and improperly handles the redirect URI. Because the application does not validate the destination, it permits redirection to external domains.\nThis flaw allows an attacker to manipulate the 'window origin' or the target path logic to facilitate an open redirect. By injecting a crafted URL into the 'switch-version' handler, the attacker successfully instructs the browser to navigate to an arbitrary malicious domain.\nThe attack is highly effective in phishing scenarios, as the initial redirect originates from a trusted HCL AION base URL, potentially bypassing browser-based security warning mechanisms or user suspicion.\nPost-exploitation impact includes the potential for session token theft, secondary social engineering attacks, or the execution of cross-site scripting (XSS) if the redirect target is configured to inject malicious scripts into the client context.\nThe issue is exacerbated by the lack of restrictive 'Referrer-Policy' or 'Content-Security-Policy' (CSP) headers that would otherwise limit the ability of the browser to follow redirects to unauthorized domains. There are no authentication requirements to trigger this redirect behavior; it is available to any user interacting with the web interface. Exposure is global as the Navbar component is a standard part of the web-based GenAI interface."
}