Description

HCL AION is affected by a vulnerability where encrypted (HTTPS) communication was not enforced for all requests. Data may be transmitted over unencrypted connections and intercepted by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-11-06T14:17:12.630Z",
  "pubdate": "2026-11-06T14:17:12.630Z",
  "executiveSummary": "HCL AION suffers from a critical security deficiency regarding the enforcement of Transport Layer Security (TLS) for network communications.\nThe vulnerability involves the failure to mandate HTTPS for all application requests, permitting the transmission of sensitive data over unencrypted channels.\nThis exposure allows unauthorized third parties positioned on the network path to perform Man-in-the-Middle (MitM) attacks.\nThe primary risk entails the interception, inspection, and potential manipulation of transit data, which may lead to unauthorized information disclosure or the compromise of session integrity.\nThe issue affects the HCL AION product line and necessitates immediate architectural changes to ensure protocol-level traffic security.\nExploitation requires the attacker to be situated within the communication path between the client and the server, such as through ARP spoofing, DNS poisoning, or compromised intermediate network infrastructure.",
  "technicalDetails": "The root cause of this vulnerability is the absence of a strict transport-layer enforcement policy within the HCL AION communication stack. While the application is capable of utilizing HTTPS, it fails to enforce TLS-only communication, allowing fallback or initial negotiation via cleartext HTTP protocols. This failure to mandate encryption creates a state of insecure transit that bypasses the confidentiality and integrity guarantees provided by standard cryptographic protocols.\nThe exploitation flow begins with an attacker positioned in an advantageous network location, such as a local area network (LAN) or an untrusted intermediate node. By utilizing common network-layer interception techniques like ARP cache poisoning or rogue gateway advertisement, the attacker intercepts the initial request flows from the client to the HCL AION server. Because the application does not enforce HTTP Strict Transport Security (HSTS) or mandate HTTPS at the application gateway level, the client may be induced or permitted to transmit requests in plain text.\nOnce the traffic is intercepted, the attacker can conduct a Man-in-the-Middle (MitM) operation. By observing the unencrypted traffic, the attacker can capture sensitive authentication tokens, session identifiers, and proprietary data payloads. In scenarios where the application processes requests that influence state or business logic, the attacker can perform content injection or modify parameters within the cleartext stream. This could result in unauthorized administrative actions or the exfiltration of sensitive configuration data.\nThe vulnerability is inherent to the network transport layer of the HCL AION component, which lacks a hardened configuration to reject non-encrypted inbound requests. The impact is significant as it negates the primary security controls designed to protect data in motion, essentially nullifying the efficacy of any underlying application-level authentication if the session tokens themselves are transmitted without encryption. There are no privilege requirements for the attacker to initiate this interception, provided they have achieved a foothold on the network segment or the routing infrastructure. The post-exploitation impact includes full data disclosure of intercepted streams, session hijacking, and the potential for persistent control if the intercepted payloads include actionable credentials or authorization headers."
}