CVE-2024-51321

HighPublic PoC

Published: 11 March 2025

Published

11 March 2025

Modified

28 May 2025

KEV Added

—

Patch

—

CVSS Score 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H

EPSS Score 0.0023 45.1th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-51321 is a high-severity Open Redirect (CWE-601) vulnerability in Zucchetti Ad Hoc Infinity. Its CVSS base score is 7.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Spearphishing Link (T1566.002); ranked at the 45.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-4 (Information Flow Enforcement).

Threat & Defense at a Glance

What attackers do: exploitation maps to Spearphishing Link (T1566.002) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Requires validation of the m_cURL parameter to ensure it only contains trusted URLs, directly preventing redirection to attacker-controlled sites.

AC-4 Information Flow Enforcement partial match

prevent

Enforces approved information flow policies that can restrict post-authentication redirects to only authorized domains.

SI-15 Information Output Filtering partial match

prevent

Filters output such as redirect URLs to block untrusted destinations generated from the m_cURL parameter.

MITRE ATT&CK Enterprise TechniquesAI

T1566.002 Spearphishing Link Initial Access

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.

attack.mitre.org →

T1204.001 Malicious Link Execution

An adversary may rely upon a user clicking a malicious link in order to gain execution.

attack.mitre.org →

Why these techniques?

The open redirect vulnerability (CWE-601) directly enables crafting of URLs that redirect authenticated users to attacker-controlled sites, facilitating spearphishing via malicious links (T1566.002) and user execution upon clicking such links (T1204.001) for phishing or credential theft.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

NVD Description

In Zucchetti Ad Hoc Infinity 2.4, an improper check on the m_cURL parameter allows an attacker to redirect the victim to an attacker-controlled website after the authentication.

Deeper analysisAI

CVE-2024-51321 affects Zucchetti Ad Hoc Infinity 2.4 and stems from an improper check on the m_cURL parameter. This vulnerability, classified as CWE-601 (URL Redirection to Untrusted Site), enables an attacker to redirect a victim to an attacker-controlled website following authentication. It carries a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H), indicating high severity due to its potential for significant integrity and availability impacts.

The attack requires network access, low complexity, low privileges (such as an authenticated account), and user interaction from the victim. An attacker with low privileges can manipulate the m_cURL parameter to trick an authenticated user into being redirected to a malicious site after login, potentially enabling phishing, credential theft, or further exploitation, with low confidentiality impact but high effects on integrity and availability.

Mitigation details are available in the advisory published by BackBox at https://members.backbox.org/zucchetti-ad-hoc-infinity-multiple-vulnerabilities/.