Description

HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure, allowing application resources to be loaded by other origins. This may expose resources to cross-origin data leakage, potentially resulting in unintended behavior or security impact under certain conditions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-11-06T14:17:12.777Z",
  "pubdate": "2026-11-06T14:17:12.777Z",
  "executiveSummary": "HCL AION is susceptible to a security misconfiguration involving the improper implementation of the Cross-Origin-Resource-Policy (CORP) HTTP response header.\nThe vulnerability occurs because the application fails to restrict resource access via CORP, potentially permitting unauthorized cross-origin requests.\nThis flaw exposes sensitive application resources to cross-origin data leakage, which could lead to unauthorized information disclosure or unintended cross-site interactions.\nThe attack is passive in nature, requiring no direct authentication from the victim to the target origin, but typically relies on the victim visiting a malicious or compromised third-party site while authenticated to the vulnerable application.\nThe risk implication is that an attacker can leverage a victim's browser context to perform cross-origin requests for resources that should have been protected, potentially facilitating unauthorized data extraction or side-channel information leakage.\nProper implementation of security headers is required to mitigate this risk, effectively enforcing browser-level restrictions on how resources are shared across different origins.",
  "technicalDetails": "The vulnerability in HCL AION stems from the absence or insecure configuration of the Cross-Origin-Resource-Policy (CORP) HTTP response header.\nCORP is a security mechanism that allows a server to specify which origins are permitted to load a resource. When this header is missing or configured with excessively permissive values (such as 'same-site' when stricter policies are required, or simply being absent), the browser defaults to allowing cross-origin requests for certain resource types.\nIn a typical attack scenario, an attacker hosts a malicious website. A victim, who is currently authenticated to HCL AION, visits the attacker's site.\nThe attacker's site executes a script that attempts to fetch sensitive resources from HCL AION (e.g., images, scripts, or JSON data). Because the CORP header is missing or misconfigured, the victim's browser fulfills the request, sending the victim's session cookies or other credentials along with the request to HCL AION.\nThe HCL AION server processes the request, assuming it is legitimate due to the presence of valid authentication tokens, and returns the requested data to the browser. The attacker's script, running in the context of the malicious site, can then intercept or observe the response, leading to data leakage.\nThis exposure is exacerbated by the fact that browsers are designed to automatically include credentials in cross-origin requests if not restricted by policies like CORP or Cross-Origin Embedder Policy (COEP).\nThe lack of restrictive CORP headers bypasses browser-enforced security boundaries that are intended to prevent cross-origin resource leakage, essentially treating the application as a public resource provider rather than a restricted origin.\nPost-exploitation impact includes the ability to exfiltrate data that should only be accessible within the application's origin, potentially revealing user-specific information, metadata, or sensitive application state, depending on the nature of the resources accessible via this vector."
}