CVE-2024-10288: Ujangrohidin Localserver XSS Vulnerability

CVE-2024-10288 Overview

CVE-2024-10288 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Ujangrohidin LocalServer version 1.0.9. The flaw resides in the /mlss/SubscribeToList endpoint, where the ListName parameter is not properly sanitized before being reflected in the response. A remote attacker can craft a malicious URL and deliver it to an authenticated user to execute arbitrary JavaScript in the victim's browser context. Successful exploitation can lead to session token theft and impersonation of the authenticated user.

Critical Impact
Attackers can steal authenticated session details and hijack user accounts by tricking victims into clicking a crafted link targeting the ListName parameter.

Affected Products

Ujangrohidin LocalServer 1.0.9
Component: ujangrohidin:localserver
Affected endpoint: /mlss/SubscribeToList (parameter ListName)

Discovery Timeline

2024-10-23 - CVE-2024-10288 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10288

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the LocalServer web application. The /mlss/SubscribeToList handler accepts a user-supplied ListName query parameter and renders its value directly into the HTTP response without encoding or sanitization. When the response is interpreted by the browser, injected script content executes within the origin of the vulnerable application. Because the exploit requires the target to be authenticated and to interact with a crafted link, the attack pattern typically involves phishing or social engineering delivery.

The attacker's payload runs with the privileges of the victim's session, granting access to cookies, local storage, and any authenticated API endpoints reachable from the browser. Session details can then be exfiltrated to an attacker-controlled endpoint to enable account takeover.

Root Cause

The root cause is missing output encoding and input validation on the ListName parameter before it is rendered in the server response. The application trusts client-supplied input and echoes it into HTML without contextual escaping, satisfying the classic reflected XSS pattern described in CWE-79.

Attack Vector

The attack is delivered over the network and requires user interaction. An attacker crafts a URL pointing to /mlss/SubscribeToList with a malicious payload in the ListName parameter. The attacker sends the link to an authenticated LocalServer user through email, chat, or a third-party website. When the victim clicks the link, the injected script executes and can read session cookies or perform actions on behalf of the user. Additional technical detail is available in the INCIBE CERT Security Notice.

Detection Methods for CVE-2024-10288

Indicators of Compromise

HTTP requests to /mlss/SubscribeToList containing <script>, javascript:, onerror=, or URL-encoded equivalents in the ListName parameter.
Outbound browser requests to unknown domains immediately after users visit LocalServer URLs, indicating potential session exfiltration.
Unexpected session reuse from geographically distant IP addresses following user clicks on external links.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the ListName query parameter for HTML tags, script keywords, and event handler attributes.
Enable server-side request logging on the /mlss/ path and alert on parameter values containing angle brackets or encoded script fragments.
Correlate web server access logs with endpoint browser telemetry to identify users who received and rendered crafted URLs.

Monitoring Recommendations

Monitor authentication logs for session token reuse from multiple source addresses within short time windows.
Track referrer headers on LocalServer requests to identify off-domain phishing pages driving traffic to /mlss/SubscribeToList.
Alert on Content Security Policy (CSP) violation reports if CSP headers are enabled in the environment.

How to Mitigate CVE-2024-10288

Immediate Actions Required

Restrict external network access to LocalServer 1.0.9 deployments until a fixed version is available.
Instruct authenticated users to avoid clicking untrusted links referencing the LocalServer application.
Invalidate active sessions and force reauthentication if suspicious traffic to /mlss/SubscribeToList is observed.

Patch Information

At the time of publication, no vendor patch or updated release is listed in the NVD entry or in the INCIBE CERT Security Notice. Administrators should monitor the vendor project for a release addressing the ListName parameter handling and apply it as soon as it becomes available.

Workarounds

Place a reverse proxy or WAF in front of LocalServer and block requests where ListName contains HTML metacharacters or script-related keywords.
Set the HttpOnly and Secure attributes on session cookies to reduce the impact of successful script execution.
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Require reauthentication for sensitive actions to limit the value of any stolen session context.

bash

# Example WAF rule pattern (ModSecurity syntax) to block script content in ListName
SecRule ARGS:ListName "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" \
    "id:1002488,phase:2,deny,status:403,log,msg:'CVE-2024-10288 LocalServer XSS attempt on ListName'"