CVE-2024-10287: Ujangrohidin Localserver XSS Vulnerability

CVE-2024-10287 Overview

CVE-2024-10287 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in Ujangrohidin LocalServer version 1.0.9. The flaw resides in the /mlss/ForgotPassword endpoint, specifically in the handling of the ListName parameter. A remote attacker can craft a malicious URL and deliver it to an authenticated user. When the target interacts with the crafted request, the injected script executes in their browser context. Successful exploitation allows session hijacking, credential theft, and unauthorized actions within the authenticated user's session.

Critical Impact
Attackers can steal session details and impersonate authenticated LocalServer users through crafted URLs targeting the ListName parameter.

Affected Products

Ujangrohidin LocalServer 1.0.9
Component: ujangrohidin:localserver
Endpoint: /mlss/ForgotPassword with vulnerable parameter ListName

Discovery Timeline

2024-10-23 - CVE-2024-10287 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10287

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the LocalServer web application. The /mlss/ForgotPassword endpoint accepts the ListName query parameter and reflects its value back into the HTTP response without proper output encoding or input sanitization. An attacker who convinces an authenticated user to click a crafted link can execute arbitrary JavaScript in the victim's browser session.

Because the payload runs in the victim's authenticated context, the attacker can read session cookies, exfiltrate CSRF tokens, and perform actions on behalf of the user. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N vector indicates the attack requires user interaction and crosses a security scope boundary because the injected script executes under the trust of the LocalServer origin.

Root Cause

The root cause is missing input validation and output encoding for the ListName request parameter. The application echoes user-supplied data directly into the HTML response body without HTML-entity encoding or context-aware escaping. This corresponds to CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation requires an attacker to construct a URL containing a JavaScript payload in the ListName parameter of /mlss/ForgotPassword. The attacker then delivers the URL through phishing, chat, or a malicious website. When an authenticated LocalServer user follows the link, the reflected script executes and can transmit session identifiers to an attacker-controlled endpoint.

For technical details, refer to the INCIBE Security Notice on multiple XSS vulnerabilities in LocalServer.

Detection Methods for CVE-2024-10287

Indicators of Compromise

HTTP requests to /mlss/ForgotPassword containing script tags, event handlers, or JavaScript URI schemes in the ListName parameter
Outbound connections from user browsers to unfamiliar domains immediately after visiting LocalServer pages
Session cookies transmitted to external hosts through unexpected fetch or XMLHttpRequest calls
URL-encoded payloads such as %3Cscript%3E or javascript: observed in web server access logs

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects query parameters on /mlss/ForgotPassword for HTML metacharacters and known XSS payload patterns
Enable request logging and alert on requests where the ListName parameter contains <, >, ", ', or script substrings
Review browser console errors and Content Security Policy (CSP) violation reports for unexpected inline script execution

Monitoring Recommendations

Aggregate LocalServer access logs into a centralized SIEM and build detections for suspicious query strings against the ForgotPassword endpoint
Correlate anomalous outbound browser traffic with recent visits to LocalServer to identify potential session exfiltration
Track authenticated session anomalies, including geographic mismatches or concurrent sessions from disparate IP addresses

How to Mitigate CVE-2024-10287

Immediate Actions Required

Restrict access to LocalServer 1.0.9 to trusted networks until a vendor patch is applied
Deploy a WAF policy that blocks reflected XSS payloads targeting the ListName parameter on /mlss/ForgotPassword
Instruct authenticated users to avoid clicking untrusted links referencing the LocalServer application
Rotate active session tokens if suspicious requests to the ForgotPassword endpoint are observed

Patch Information

No vendor patch or fixed version was referenced in the NVD entry at the time of publication. Monitor the INCIBE advisory and the Ujangrohidin project channels for updates and remediation guidance.

Workarounds

Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Configure server-side output encoding for all reflected parameters, applying HTML-entity encoding for values rendered in HTML contexts
Apply the HttpOnly and Secure attributes to session cookies to reduce the impact of script-based cookie theft
Use a reverse proxy to sanitize or reject requests containing HTML control characters in query parameters targeting /mlss/ForgotPassword

bash

# Example WAF rule (ModSecurity) blocking XSS payloads in ListName
SecRule REQUEST_URI "@beginsWith /mlss/ForgotPassword" \
  "chain,id:1002487,phase:2,deny,status:403,\
   msg:'CVE-2024-10287 XSS attempt on ListName parameter'"
  SecRule ARGS:ListName "@rx (?i)(<script|javascript:|onerror=|onload=|<img)" \
    "t:none,t:urlDecodeUni,t:htmlEntityDecode"