CVE-2024-10286: Localserver XSS Vulnerability

CVE-2024-10286 Overview

CVE-2024-10286 is a reflected Cross-Site Scripting (XSS) vulnerability affecting Ujangrohidin LocalServer version 1.0.9. The flaw resides in the /testmail/index.php endpoint, where the to parameter does not sanitize user-supplied input before rendering it in the response. A remote attacker can craft a malicious URL and deliver it to an authenticated user. When the victim loads the link, injected JavaScript executes within the application context, allowing session detail theft. The weakness maps to CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation enables attackers to hijack authenticated sessions and perform actions on behalf of the compromised user.

Affected Products

Ujangrohidin LocalServer 1.0.9
Component: ujangrohidin:localserver
Vulnerable endpoint: /testmail/index.php (to parameter)

Discovery Timeline

2024-10-23 - CVE-2024-10286 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10286

Vulnerability Analysis

The vulnerability is a reflected XSS in the testmail component of LocalServer 1.0.9. The index.php script accepts the to query parameter and echoes its value into the HTML response without encoding or filtering. An attacker constructs a URL that embeds JavaScript inside the to parameter, then delivers the link through phishing, chat, or a third-party site. When an authenticated user visits the link, the browser renders the attacker's payload within the LocalServer origin.

Because the payload executes in the victim's authenticated context, it can read session cookies, exfiltrate CSRF tokens, or issue requests to backend handlers. User interaction is required, which aligns with the CVSS vector component UI:R. The scope change (S:C) indicates the injected script can affect resources beyond the vulnerable component's security authority.

Root Cause

The root cause is missing output encoding and input validation on the to request parameter in /testmail/index.php. The application reflects attacker-controlled data directly into the HTML response context, violating the CWE-79 requirement to neutralize special characters before web page generation.

Attack Vector

Exploitation occurs over the network and requires no privileges. The attacker crafts a URL containing a malicious to parameter value, for example a <script> tag or event handler payload. The attacker then lures an authenticated LocalServer user into clicking the link. The payload executes under the application's origin, enabling session detail theft as described in the INCIBE Security Notice on XSS Vulnerabilities in LocalServer.

Detection Methods for CVE-2024-10286

Indicators of Compromise

HTTP requests to /testmail/index.php containing <, >, script, onerror, or URL-encoded equivalents (%3Cscript%3E) in the to parameter.
Outbound requests from user browsers to unknown domains immediately after visiting LocalServer URLs, indicating payload exfiltration.
Unexpected session reuse from new IP addresses or user agents following a user clicking an inbound LocalServer link.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query parameters on /testmail/index.php for XSS payload signatures.
Review web server access logs for abnormal to parameter lengths or encoded script fragments.
Correlate referrer headers against known phishing domains to identify delivery of malicious LocalServer URLs.

Monitoring Recommendations

Enable verbose HTTP request logging on the LocalServer host and ship logs to a centralized analytics platform for query-based hunting.
Alert on authenticated sessions that generate unusual client-side activity, such as rapid cookie access or cross-origin requests.
Monitor for repeated 200 responses to /testmail/index.php requests carrying angle brackets or JavaScript keywords in parameters.

How to Mitigate CVE-2024-10286

Immediate Actions Required

Restrict access to the /testmail/ directory at the web server level until a vendor patch is applied.
Instruct users not to click LocalServer links received from untrusted sources.
Invalidate active sessions and rotate authentication cookies for users suspected of interacting with crafted URLs.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Administrators should monitor the INCIBE advisory and the Ujangrohidin project for an updated release that supersedes LocalServer 1.0.9.

Workarounds

Apply a reverse-proxy rule that strips or encodes <, >, ", and ' characters in the to parameter of /testmail/index.php.
Deploy a Content Security Policy (CSP) header that disables inline scripts and restricts script sources to trusted origins.
Enable the HttpOnly and SameSite=Strict attributes on session cookies to limit theft via client-side script.

bash

# Example NGINX rule to block script-like payloads in the vulnerable parameter
location /testmail/index.php {
    if ($arg_to ~* "(<|%3C)[^>]*script") {
        return 403;
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'";
    add_header X-XSS-Protection "1; mode=block";
}