BAE SOCET GXP Job Status Service Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in BAE SOCET GXP versions prior to 4.6.0.2. The issue arises in the SOCET GXP Job Status Service, which fails to adequately sanitize the job ID parameter before it is displayed on the job status page. This lack of proper input validation allows an attacker to execute arbitrary JavaScript in the browser of a user who is tricked into clicking a malicious link.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute scripts in the context of the victim's browser session.

Remediation

Users are advised to update to SOCET GXP version 4.6.0.3, which removes the Job Status Service web page entirely, or version 4.6.0.2, which disables the Job Status Service by default. If an immediate update is not possible, the Job Status Service HTTP endpoint can be disabled manually by changing the 'HTTP_SERVER' setting in the 'GXPJobService/js-config.xml' file, then restarting SOCET GXP. This setting can be left in place until SOCET GXP is updated.