CVE-2026-31013: Dovestones AD Phonebook XSS Vulnerability

CVE-2026-31013 Overview

CVE-2026-31013 is a reflected cross-site scripting (XSS) vulnerability affecting Dovestones Softwares ADPhonebook versions prior to 4.0.1.1. The vulnerability exists in the search parameter of the /ADPhonebook?Department=HR endpoint, where user-supplied input is reflected in the HTTP response without proper input validation or output encoding. This allows attackers to execute arbitrary JavaScript code in the context of a victim's browser session.

Critical Impact

Attackers can exploit this XSS vulnerability to steal session cookies, capture user credentials, perform unauthorized actions on behalf of authenticated users, or redirect victims to malicious websites.

Affected Products

• Dovestones ADPhonebook versions prior to 4.0.1.1
• dovestones ad_phonebook (all versions matching cpe:2.3:a:dovestones:ad_phonebook:*:*:*:*:*:*:*:*)

Discovery Timeline

• 2026-04-21 - CVE-2026-31013 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-31013

Vulnerability Analysis

This reflected XSS vulnerability (CWE-79) occurs when the ADPhonebook application fails to properly sanitize user input before including it in the HTTP response. The search parameter in the /ADPhonebook?Department=HR endpoint directly echoes user-supplied content back to the browser without encoding special characters. This allows an attacker to inject malicious JavaScript code that executes within the security context of the vulnerable application.

The attack requires user interaction—a victim must click on a malicious link containing the XSS payload. Once executed, the injected script runs with the same privileges as the legitimate application, enabling attackers to access sensitive information, modify page content, or perform actions on behalf of the user.

Root Cause

The root cause is insufficient input validation and missing output encoding in the search parameter handling logic. The application directly reflects user input into the HTML response without sanitizing or encoding characters that have special meaning in HTML/JavaScript contexts (such as <, >, ", and ').

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a malicious URL containing a JavaScript payload in the search parameter and tricks the victim into clicking the link. This can be accomplished through phishing emails, malicious advertisements, or compromised websites. When the victim visits the crafted URL, the ADPhonebook application reflects the malicious payload in the response, causing the victim's browser to execute the attacker's JavaScript code.

The vulnerability manifests in the search functionality where unsanitized user input is reflected in the HTTP response. Technical details and proof-of-concept code are available at the GitHub Gist Exploit Code.

Detection Methods for CVE-2026-31013

Indicators of Compromise

• Unusual URL patterns in web server logs containing JavaScript code fragments in the search parameter (e.g., <script>, javascript:, onerror=, onload=)
• HTTP requests to /ADPhonebook endpoints with encoded or obfuscated script tags
• User reports of unexpected browser behavior or pop-ups when accessing ADPhonebook
• Session tokens being transmitted to external domains

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block common XSS patterns in URL parameters
• Enable detailed logging on web servers to capture full request URIs for forensic analysis
• Implement Content Security Policy (CSP) headers to detect policy violations that may indicate XSS attempts
• Use browser-based XSS auditors and security extensions to identify reflected script execution

Monitoring Recommendations

• Monitor web application logs for requests containing suspicious characters or encoding patterns in query strings
• Set up alerts for high volumes of requests to the /ADPhonebook endpoint with unusual parameter values
• Track any CSP violation reports that may indicate attempted or successful XSS exploitation
• Review authentication logs for session anomalies that could indicate session hijacking

How to Mitigate CVE-2026-31013

Immediate Actions Required

• Upgrade Dovestones ADPhonebook to version 4.0.1.1 or later immediately
• Implement input validation to reject or sanitize special characters in the search parameter
• Apply output encoding to all user-supplied data before rendering in HTML responses
• Deploy Content Security Policy (CSP) headers to restrict inline script execution

Patch Information

Dovestones has released version 4.0.1.1 to address this vulnerability. The updated version is available from the Dovestones Download Page. Organizations should prioritize upgrading to the patched version to eliminate this XSS vulnerability.

Workarounds

• Implement a Web Application Firewall (WAF) with XSS filtering rules to block malicious payloads targeting the search parameter
• Add Content-Security-Policy headers with strict directives such as script-src 'self' to prevent inline script execution
• Restrict access to the ADPhonebook application to trusted internal networks until patching is complete
• Educate users about the risks of clicking on untrusted links, especially those containing unusual URL parameters

# Example: Add Content-Security-Policy header in Apache
# Add to .htaccess or httpd.conf
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"

# Example: Add X-XSS-Protection header (legacy browsers)
Header set X-XSS-Protection "1; mode=block"