CVE-2021-44043 : Security Advisory and Response

UiPath App Studio 21.4.4 is affected by a persistent XSS vulnerability in the file-upload functionality, allowing attackers to upload malicious files.

Understanding CVE-2021-44043

What is CVE-2021-44043?

CVE-2021-44043 is a persistent Cross-Site Scripting (XSS) vulnerability discovered in UiPath App Studio 21.4.4. It enables attackers with minimal privileges to upload malicious files containing XSS payloads.

The Impact of CVE-2021-44043

The vulnerability in file-upload functionality can lead to the execution of arbitrary code, potentially compromising the security and integrity of the application and users' data.

Technical Details of CVE-2021-44043

Vulnerability Description

The issue stems from the file-upload feature when creating new Apps in UiPath App Studio, allowing the uploading of icons. Attackers can abuse this to upload files with XSS payloads.

Affected Systems and Versions

Product: UiPath App Studio 21.4.4
Vendor: UiPath
Versions: All versions up to 21.4.4 are affected

Exploitation Mechanism

Attacker gains minimal privileges in the application
Uploads a malicious file with XSS payload by modifying the MIME type
Malicious file is stored and retrieved from the server within the organization

Mitigation and Prevention

Immediate Steps to Take

Disable file-upload functionality temporarily
Educate users about not opening files from untrusted sources
Implement input validation to filter out potentially malicious files

Long-Term Security Practices

Regularly update and patch the application to fix vulnerabilities
Conduct security audits and penetration testing to identify and address vulnerabilities proactively

Patching and Updates

Apply updates and security patches provided by UiPath promptly to address the XSS vulnerability