SohuTV CacheCloud Cross-Site Scripting Vulnerability in Login Controller

A cross-site scripting (XSS) vulnerability has been identified in SohuTV CacheCloud versions through 3.2.0. The issue arises in the LoginController.java file, specifically within the init function. The vulnerability allows for remote exploitation, as user-controllable parameters are not properly encoded before being displayed on the web page, enabling attackers to execute XSS attacks against users.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a GET request to the '/manage/login' endpoint with a crafted 'redirectUrl' parameter that includes a script payload. The server response will reflect the injected script, demonstrating the cross-site scripting vulnerability.