CVE-2024-49379
Published: 13 November 2024
Summary
CVE-2024-49379 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Github (inferred from references). Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 8.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Umbrel is a home server OS for self-hosting that contained a reflected cross-site scripting vulnerability in its login functionality prior to version 1.2.2. The flaw resides in use-auth.tsx and is triggered when a malicious redirect query parameter is supplied; specifically, a javascript: URL causes attacker-controlled script to execute after a user submits valid credentials.
An unauthenticated attacker can craft a link containing the malicious redirect parameter and deliver it to a target user. Once the victim authenticates, the injected JavaScript runs in the user's session context, enabling actions such as theft of session data or other client-side manipulation without requiring further privileges.
The issue is resolved in Umbrel 1.2.2, as noted in the project's release notes and the associated commit that addresses the redirect handling. The corresponding GitHub Security Lab advisory provides additional technical detail on the root cause.
EPSS for this CVE remains flat at 0.0655 with no material increase observed since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-43723
Vulnerability details
Umbrel is a home server OS for self-hosting. The login functionality of Umbrel before version 1.2.2 contains a reflected cross-site scripting (XSS) vulnerability in use-auth.tsx. An attacker can specify a malicious redirect query parameter to trigger the vulnerability. If a…
more
JavaScript URL is passed to the redirect parameter the attacker provided JavaScript will be executed after the user entered their password and clicked on login. This vulnerability is fixed in 1.2.2.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.