CVE-2021-32604: 
Serv-U Managed File Transfer Server vulnerability analysis and mitigation

Share/IncomingWizard.htm in SolarWinds Serv-U before version 15.2.3 contains a cross-site scripting (XSS) vulnerability due to improper handling of the user-supplied SenderEmail parameter in the Share URL feature, also known as 'Share URL XSS'. The vulnerability was discovered and disclosed in July 2021 (SpiderLabs Blog).

The vulnerability exists in the 'Request Files' feature where the Sender Email input is not properly encoded when being placed in a publicly accessible share URL. An authenticated user can generate a file request URL with a malicious XSS payload in the 'SenderEmail' field, which gets executed when the shared URL is visited. The vulnerability allows creation of a publicly accessible URL that triggers an XSS payload when accessed (SpiderLabs Blog).

When exploited, this vulnerability could allow an attacker to execute malicious JavaScript code in the context of other users' browsers who visit the specially crafted share URL. This could potentially lead to session hijacking, credential theft, or other client-side attacks (SpiderLabs Blog).

The vulnerability requires authentication to create the malicious URL, but the resulting URL is publicly accessible and can be sent to potential victims. A proof-of-concept exploit has been demonstrated that allows intercepting uploaded files and sending them to a third-party server without altering the page view (SpiderLabs Blog).

Users should upgrade to SolarWinds Serv-U version 15.2.3 or later which contains the fix for this vulnerability (SolarWinds Release Notes).