CVE-2024-10289: Ujangrohidin Localserver XSS Vulnerability

CVE-2024-10289 Overview

CVE-2024-10289 is a reflected Cross-Site Scripting (XSS) vulnerability in ujangrohidin LocalServer 1.0.9. The flaw resides in the /mlss/ManageSubscription endpoint, where the MSubListName parameter is reflected into the response without proper sanitization. A remote attacker can craft a malicious URL and deliver it to an authenticated user. When the victim visits the link, attacker-controlled JavaScript executes in the browser context of the application. This enables session theft, account hijacking, and unauthorized actions performed under the victim's identity. The issue is cataloged under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can hijack authenticated sessions and perform actions on behalf of victims by delivering a crafted link that triggers script execution in the LocalServer web interface.

Affected Products

ujangrohidin LocalServer 1.0.9
Deployments exposing the /mlss/ManageSubscription endpoint
Any authenticated session interacting with the vulnerable parameter MSubListName

Discovery Timeline

2024-10-23 - CVE CVE-2024-10289 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10289

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the subscription management workflow of LocalServer 1.0.9. User-supplied input to the MSubListName parameter at /mlss/ManageSubscription is written back into HTML responses without encoding or filtering. An attacker who can convince an authenticated user to click a crafted URL triggers execution of arbitrary JavaScript within the trusted origin. Because the script runs under the victim's active session, it can read cookies not protected by HttpOnly, exfiltrate CSRF tokens, and submit application requests. The scope change in the attack vector indicates impact crosses the vulnerable component's security boundary, affecting data visible to the victim's browser.

Root Cause

The root cause is missing output encoding on the MSubListName request parameter before it is reflected in server-generated HTML. The application does not apply contextual escaping for HTML, attribute, or JavaScript contexts, allowing payloads such as inline <script> tags or event handlers to break out of the intended data context. User interaction is required because the attack depends on a victim following a prepared link.

Attack Vector

Exploitation is network-based and requires no authentication from the attacker, only social engineering of an authenticated LocalServer user. The attacker constructs a URL to /mlss/ManageSubscription with a crafted MSubListName value containing JavaScript. When the authenticated victim loads the URL, the browser executes the payload in the LocalServer origin. See the INCIBE Security Notice on XSS for additional context on the reported issue.

No verified exploit code is published. The vulnerability is
triggered by supplying a crafted value to the MSubListName
parameter on /mlss/ManageSubscription that is reflected into
the HTML response without encoding.

Detection Methods for CVE-2024-10289

Indicators of Compromise

Web server access logs showing requests to /mlss/ManageSubscription with MSubListName values containing <, >, script, onerror, onload, or URL-encoded equivalents (%3C, %3E).
Outbound HTTP requests from user browsers to unknown domains shortly after visiting LocalServer URLs.
Unexpected session activity or configuration changes performed by authenticated accounts.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that flags reflected XSS payload patterns in the MSubListName query parameter.
Enable Content Security Policy (CSP) reporting and alert on script-src violations originating from LocalServer pages.
Correlate referrer headers pointing to external hosts with subsequent authenticated POST actions in LocalServer.

Monitoring Recommendations

Centralize LocalServer HTTP access logs and parse query strings for suspicious characters and script keywords.
Monitor browser-side telemetry for anomalous DOM modifications or token exfiltration on administrative pages.
Alert on repeated requests to /mlss/ManageSubscription from the same source with varying MSubListName payloads, indicating payload fuzzing.

How to Mitigate CVE-2024-10289

Immediate Actions Required

Restrict access to /mlss/ManageSubscription to trusted networks until a patched version is available.
Enforce a strict Content Security Policy that disallows inline scripts and limits allowed script sources.
Train administrators to avoid clicking LocalServer links received from untrusted sources.
Set the HttpOnly and Secure flags on session cookies to reduce the value of stolen session data.

Patch Information

No vendor advisory or fixed version is listed in the NVD record at the time of writing. Refer to the INCIBE Security Notice on XSS for vendor coordination updates and track the ujangrohidin/localserver project for a release that encodes the MSubListName parameter output.

Workarounds

Place LocalServer behind a reverse proxy that sanitizes or rejects requests containing script metacharacters in MSubListName.
Apply a WAF signature blocking common XSS payload tokens on the /mlss/ManageSubscription path.
Terminate authenticated sessions after short inactivity windows to reduce the window for session hijacking.

bash

# Example NGINX rule to block script metacharacters in MSubListName
location /mlss/ManageSubscription {
    if ($arg_MSubListName ~* "(<|>|script|onerror|onload|%3C|%3E)") {
        return 403;
    }
    proxy_pass http://localserver_backend;
}