CVE-2023-45358
📋 TL;DR
This stored cross-site scripting (XSS) vulnerability in Archer Platform allows authenticated attackers to inject malicious scripts into the application's data store. When other users access the compromised data, their browsers execute the attacker's code within the trusted Archer application context. This affects Archer Platform 6.x versions before specific patches.
💻 Affected Systems
- Archer Platform
📦 What is this software?
Archer by Archerirm
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as victims, exfiltrate sensitive data, or deploy additional malware within the Archer environment.
Likely Case
Session hijacking, data theft, or unauthorized actions performed under victim user accounts.
If Mitigated
Limited impact with proper input validation, output encoding, and content security policies in place.
🎯 Exploit Status
Requires authenticated user access. Stored XSS typically has low exploitation complexity once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.13 P2 HF2 (6.13.0.2.2) or 6.14.0
Vendor Advisory: https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/708617
Restart Required: Yes
Instructions:
1. Download the patch from RSA Archer support portal. 2. Apply patch following Archer upgrade procedures. 3. Restart Archer services. 4. Verify successful installation.
🔧 Temporary Workarounds
Input Validation Enhancement
allImplement additional input validation for user-supplied data in Archer forms and fields
Content Security Policy
allImplement strict CSP headers to restrict script execution
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to detect and block XSS payloads
- Restrict user permissions to minimize attack surface and implement principle of least privilege
🔍 How to Verify
Check if Vulnerable:
Check Archer Platform version via Archer Control Panel or administrative interfaceCheck Version:
Check Archer version in administrative console or via Archer APIVerify Fix Applied:
Verify version is 6.13.0.2.2 or higher, or 6.14.0 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual HTML/JavaScript patterns in user input logs
- Multiple failed XSS attempts in web server logs
Network Indicators:
- Suspicious outbound connections from Archer server following user interactions
SIEM Query:
source="archer_logs" AND (message="*<script>*" OR message="*javascript:*" OR message="*onerror=*" OR message="*onload=*")