Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.
When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.
If you cannot upgrade immediately, either of the following measures prevents exploitation:
- Enable the built-in Content Security Policy by setting com.unblu.contentsecuritypolicy.mode=on. The CSP blocks the injected JavaScript from executing and prevents the exploit from succeeding. Note: this protection is only effective on Unblu Spark 7.56.2 or later in the 7.x series and 8.19.1 or later in the 8.x series, where unsafe-inline was removed from the script source policy. Earlier versions ship a CSP that still permits unsafe-inline and are not protected by this workaround.
- Configure a WAF rule to block requests that carry a malicious payload in the redirectOnFailure parameter (in particular, values containing a javascript: scheme or obfuscated variants such as java%0ascript:).
In the fix versions listed above, Unblu Spark validates all user-supplied redirects through the same redirect filter.
After upgrading, please review your redirect filter configuration. The defaults restrict redirects to the current origin (document.location.origin).