SNS Enrollment Portal: Stored cross-site scripting (CVE-2026-113810)

The SNS Enrollment Portal contains a stored cross-site scripting (XSS) vulnerability, identified as CVE-2026-113810. An unauthenticated attacker can exploit this by submitting a crafted payload during the certificate creation request via the portal. The malicious script is stored within the portal and is subsequently triggered when a system administrator views or validates the certificate request. This vulnerability poses a significant risk to the administrative environment, as successful exploitation could lead to administrative session compromise, unauthorized actions, or further interaction with the management interface under the context of the administrator's account. Defenders should monitor for anomalous inputs within the enrollment portal's certificate request fields.

Attack Chain

1. Attacker navigates to the public-facing SNS Enrollment Portal captive portal.
2. Attacker initiates a certificate creation request.
3. Attacker injects a JavaScript payload into one of the user-supplied fields during the enrollment process.
4. The application processes the request and saves the malicious script into the internal portal database.
5. An administrator logs into the administrative console of the SNS Enrollment Portal.
6. The administrator accesses the list of pending certificate requests to perform validation.
7. The browser renders the stored malicious script in the administrator's session context.
8. The script executes, potentially allowing the attacker to steal administrative session cookies or perform unauthorized administrative actions.

Impact

Successful exploitation of this vulnerability allows for the compromise of administrative sessions within the SNS Enrollment Portal. This can result in unauthorized modifications, unauthorized certificate issuance, or the potential for lateral movement from the portal to deeper administrative functions, depending on the privileges and scope of the affected administrator.

Recommendation

• Monitor web server logs and application logs for unusual characters, such as <script>, javascript:, or other HTML/JS tags, in fields associated with the certificate enrollment portal.
• Implement strict input validation and output encoding for all user-supplied data accepted by the SNS Enrollment Portal to prevent script injection.
• Audit administrative access logs to identify unusual patterns occurring immediately after viewing certificate enrollment requests.
• Ensure that the SNS Enrollment Portal is updated to the latest vendor-provided version that addresses CVE-2026-113810.