CVE-2021-35483: Nokia IMPACT XSS Vulnerability

CVE-2021-35483 Overview

CVE-2021-35483 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Applications component of Nokia IMPACT IoT Platform. The flaw allows an authenticated user to arbitrarily upload JavaScript files via the /ui/rest-proxy/application fileupload parameter. This upload capability is accessible during both the addition of new applications and the modification of existing ones. When another authenticated user visits the web page where the malicious file is published, the embedded JavaScript code executes in their browser context.

Critical Impact

Authenticated attackers can inject and store malicious JavaScript that executes in victims' browsers, potentially leading to session hijacking, credential theft, and unauthorized actions within the Nokia IMPACT management console.

Affected Products

• Nokia IMPACT IoT Platform through version 19.11.2.10-20210118042150283
• Nokia IMPACT Applications Component
• Nokia IMPACT Web Interface (/ui/rest-proxy/application endpoint)

Discovery Timeline

• 2026-03-03 - CVE-2021-35483 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2021-35483

Vulnerability Analysis

This vulnerability falls under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The Nokia IMPACT platform fails to properly validate and sanitize file uploads through its Applications component, allowing authenticated users to upload files containing malicious JavaScript code.

The attack requires adjacent network access and low-privilege authentication, combined with user interaction from a victim who must navigate to the page hosting the uploaded malicious content. Once triggered, the stored XSS payload executes with the privileges of the viewing user's session, enabling potential data exfiltration, session token theft, or unauthorized configuration changes within the IoT platform.

The Nokia IMPACT IoT Platform is widely deployed for managing Internet of Things devices and infrastructure, making this vulnerability particularly concerning for enterprise environments where administrative access could provide attackers with control over connected IoT assets.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and output encoding within the file upload functionality of the Applications component. The platform does not properly inspect or sanitize the contents of uploaded files, nor does it implement Content Security Policy (CSP) headers that would prevent the execution of injected scripts. The /ui/rest-proxy/application endpoint accepts JavaScript files without verification, and the application subsequently serves these files without proper content-type restrictions or script blocking mechanisms.

Attack Vector

The attack is executed via the adjacent network, requiring the attacker to have authenticated access to the Nokia IMPACT platform. The exploitation process involves:

1. Authenticating to the Nokia IMPACT web interface with valid credentials
2. Navigating to the application management section
3. Uploading a crafted JavaScript file via the fileupload parameter to /ui/rest-proxy/application
4. Waiting for another authenticated user to access the page where the malicious file is rendered
5. The malicious JavaScript executes in the victim's browser with their session context

The vulnerability can be triggered during routine application management tasks, making it particularly insidious as victims may not realize they are accessing malicious content. For detailed technical analysis, see the Gruppo TIM security advisory.

Detection Methods for CVE-2021-35483

Indicators of Compromise

• Unusual JavaScript file uploads to the /ui/rest-proxy/application endpoint
• Web server logs showing repeated access to uploaded application files containing JavaScript
• Unexpected session activity or privilege changes following file uploads
• Browser console errors or unexpected script execution warnings when accessing application pages

Detection Strategies

• Monitor HTTP POST requests to /ui/rest-proxy/application for file uploads containing JavaScript or HTML content
• Implement web application firewall (WAF) rules to detect and block file uploads with executable script content
• Review audit logs for application creation or modification events that include file attachments
• Deploy browser-based XSS detection tools that flag suspicious script execution patterns

Monitoring Recommendations

• Enable detailed logging on the Nokia IMPACT platform to capture all file upload activities
• Configure SIEM alerts for anomalous user behavior patterns, particularly around file upload and application management functions
• Implement network traffic analysis to detect script injection attempts within HTTP requests
• Regularly audit uploaded files within the Applications component for malicious content

How to Mitigate CVE-2021-35483

Immediate Actions Required

• Restrict access to the application management interface to only essential personnel
• Implement network segmentation to limit adjacent network access to the Nokia IMPACT platform
• Review and audit all previously uploaded application files for malicious JavaScript content
• Enable additional authentication requirements for administrative actions within the platform

Patch Information

Organizations should consult Nokia's official security resources for available patches and updated versions. For responsible disclosure information and security updates, refer to the Nokia Responsible Disclosure Notices page. Contact Nokia support directly to obtain patched versions of the IMPACT IoT Platform that address this vulnerability.

Workarounds

• Implement strict Content Security Policy (CSP) headers at the web server level to prevent inline script execution
• Configure the web server to serve uploaded files with Content-Disposition: attachment headers to prevent browser rendering
• Deploy a reverse proxy with file inspection capabilities to scan and quarantine JavaScript uploads
• Temporarily disable the file upload functionality within the Applications component if not operationally required

# Example CSP header configuration for Apache
# Add to httpd.conf or .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'"

# Example nginx configuration
# Add to server block
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'" always;