CVE-2024-53408

Vulnerability

Overview AVE System Web Client v2.1.131.13992 contains a cross-site scripting (XSS) vulnerability affecting all input fields. The root cause is insufficient security measures, such as missing HTML encoding and lack of whitelisting for attributes that allow JavaScript execution, enabling arbitrary script injection [1].

Exploitation

An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to endpoints like /website/api/GetSchedulerProfiles.rails. The PoC demonstrates injecting a malicious payload via the filter parameter, such as {"name":""}, which triggers JavaScript execution in the context of the victim's browser [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript code in the browser of an authenticated user. This can lead to data theft, session hijacking, or defacement of the web application.

Mitigation

As of the advisory, no fixed version has been released. Users are advised to apply input validation and output encoding, and to restrict access to the web client until a patch is available [1].