^{CVE-2021-23273:}Cross-Site Scripting (XSS) vulnerability in TIBCO Spotfire products allows attackers to execute stored XSS attacks requiring user interaction.

Overview

The vulnerability affects the Spotfire client component across multiple TIBCO Software products, including TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server. An attacker with low privileges could potentially inject malicious scripts that would be stored by the application and later executed when other users access the affected content. This stored XSS vulnerability could allow attackers to steal sensitive information, hijack user sessions, redirect users to malicious websites, or perform actions on behalf of the victim within the application.

The attack requires some level of access to the system and depends on human interaction from a victim other than the attacker, which somewhat limits its exploitability but doesn't diminish its potential impact if successfully executed.

Remediation

Users should upgrade to the following fixed versions based on their current product implementation:

For TIBCO Spotfire Analyst:

• If using version 10.3.3 or below: Upgrade to version 10.3.4 or higher
• If using versions 10.10.0, 10.10.1, or 10.10.2: Upgrade to version 10.10.3 or higher
• If using versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, or 11.1.0: Upgrade to version 11.2.0 or higher

For TIBCO Spotfire Analytics Platform for AWS Marketplace:

• If using version 11.1.0 or below: Upgrade to version 11.2.0 or higher

For TIBCO Spotfire Desktop:

• If using version 10.3.3 or below: Upgrade to version 10.3.4 or higher
• If using versions 10.10.0, 10.10.1, or 10.10.2: Upgrade to version 10.10.3 or higher
• If using versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, or 11.1.0: Upgrade to version 11.2.0 or higher

For TIBCO Spotfire Server:

• If using version 10.3.11 or below: Upgrade to version 10.3.12 or higher
• If using versions 10.10.0, 10.10.1, 10.10.2, or 10.10.3: Upgrade to version 10.10.4 or higher
• If using versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 11.0.0, or 11.1.0: Upgrade to version 11.2.0 or higher

Until patches can be applied, consider implementing additional security controls such as web application firewalls configured to detect and block XSS attacks, and limit access to the affected applications to trusted users only.

References

1. TIBCO Support Advisory: https://www.tibco.com/support/advisories/2021/03/tibco-security-advisory-march-9-2021-tibco-spotfire
2. TIBCO Support Services: http://www.tibco.com/services/support/advisories
3. CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html