CVE-2024-0310: Trellix Endpoint Security Web Control XSS

CVE-2024-0310 Overview

CVE-2024-0310 is a content security policy (CSP) bypass vulnerability in the Trellix Endpoint Security (ENS) Web Control browser extension. The flaw affects versions prior to 10.7.0 Update 15 running on Microsoft Windows. A remote attacker can alter response header parameters to switch the CSP into report-only mode, effectively neutralizing enforcement. Successful exploitation requires user interaction and can lead to cross-site scripting [CWE-79] execution that CSP would otherwise block. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can downgrade the Content Security Policy to report-only mode, bypassing browser-side protections that guard against script injection and mixed-content attacks.

Affected Products

Trellix Endpoint Security Web Control prior to 10.7.0 Update 15
Trellix Endpoint Security Web Control 10.7.0 base release
Microsoft Windows (host operating system)

Discovery Timeline

2024-01-10 - CVE-2024-0310 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0310

Vulnerability Analysis

The Trellix ENS Web Control extension inspects and modifies HTTP response headers as part of its web reputation and policy enforcement. The extension mishandles the Content-Security-Policy response header parameters delivered by upstream web servers. An attacker who controls a response reaching the browser can manipulate header values so that the extension processes the policy as report-only.

When CSP is set to Content-Security-Policy-Report-Only, browsers log violations but do not block them. Script sources, frame ancestors, and other directives lose their enforcement guarantees. Any injected script that would normally be blocked by the site's CSP executes in the victim's browser context. The scope change (S:C) in the CVSS vector reflects that the impact crosses the trust boundary between the extension and the protected web application.

Root Cause

The root cause is improper neutralization of user-influenced input during web page generation [CWE-79]. The extension trusts response header parameters without validating that policy directives remain in enforcing mode. This allows a controlled downgrade of the security posture that CSP is designed to guarantee.

Attack Vector

Exploitation requires the victim to visit an attacker-controlled or attacker-influenced page while the vulnerable ENS Web Control extension is active. The attacker crafts response headers that trigger the extension to treat CSP directives as report-only. Once CSP enforcement is disabled, the attacker delivers cross-site scripting payloads that would otherwise be blocked by the original policy. See the Trellix Security Advisory SB10417 for vendor-supplied technical detail.

Detection Methods for CVE-2024-0310

Indicators of Compromise

Unexpected Content-Security-Policy-Report-Only headers on sites that normally serve enforcing Content-Security-Policy headers.
Browser console CSP violation reports on protected internal applications where enforcement should block execution.
Endpoints running Trellix ENS Web Control versions earlier than 10.7.0 Update 15.

Detection Strategies

Inventory installed browser extensions and cross-reference ENS Web Control build numbers against the fixed version.
Inspect proxy or web gateway logs for anomalous CSP header rewrites between origin server and client.
Correlate CSP violation telemetry from managed browsers against expected policy baselines for internal web applications.

Monitoring Recommendations

Enable centralized collection of browser CSP violation reports through a report-uri or report-to endpoint.
Monitor Trellix ENS component versions through configuration management or endpoint inventory tooling.
Alert on outbound traffic to newly observed domains immediately after users interact with links delivered via email or messaging.

How to Mitigate CVE-2024-0310

Immediate Actions Required

Upgrade Trellix Endpoint Security Web Control to 10.7.0 Update 15 or later on all Windows endpoints.
Validate the deployed version through Trellix ePO or the ENS console after patching.
Prioritize patching for user populations with high exposure to external web content.

Patch Information

Trellix has published remediation guidance in Trellix Security Advisory SB10417. The fix is delivered in ENS Web Control 10.7.0 Update 15. Administrators should stage the update through Trellix ePolicy Orchestrator (ePO) and verify successful deployment across managed endpoints.

Workarounds

If patching is delayed, disable the ENS Web Control extension on affected endpoints until the update is applied.
Enforce strict CSP policies at the web application layer with server-side validation to reduce reliance on browser-side extension behavior.
Restrict browser access to untrusted external websites through web gateway policy for high-risk user groups.

bash

# Verify installed ENS Web Control version on Windows endpoints
reg query "HKLM\SOFTWARE\McAfee\Endpoint\Web Control" /v szProductVer