CVE-2024-40492
Published: 17 July 2024
Summary
CVE-2024-40492 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Heartbeat Heartbeat. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-40492 is a cross-site scripting vulnerability, tracked under CWE-79, that affects Heartbeat Chat version 15.2.1. The flaw resides in the setname function and carries a CVSS 3.1 score of 7.1, reflecting network attack vector, low complexity, and no required privileges or user interaction beyond the reflected context.
A remote attacker can supply a malicious payload to the setname function, causing the application to render attacker-controlled script in the context of other users' sessions. Successful exploitation enables execution of arbitrary code within the victim's browser, potentially leading to session hijacking, data theft, or further client-side actions.
Public proof-of-concept code demonstrating the issue has been published on GitHub. The associated EPSS score remains low, with a current value of 0.0768 and a peak of 0.0837.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38479
Vulnerability details
Cross Site Scripting vulnerability in Heartbeat Chat v.15.2.1 allows a remote attacker to execute arbitrary code via the setname function.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS vulnerability (CVE-2024-40492) in public-facing web application enables remote exploitation (T1190) via injected payloads in user names, executing arbitrary JavaScript in victims' browsers to steal session cookies (T1539) for account takeover.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.