CVE-2024-11182: MDaemon Email Server XSS Vulnerability

CVE-2024-11182 Overview

CVE-2024-11182 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in MDaemon Email Server versions prior to 24.5.1c. An attacker sends an HTML email that contains JavaScript embedded within an img tag. When a webmail user opens the message, the browser executes the attacker-controlled script in the context of the victim's webmail session.

The flaw enables session hijacking, mailbox content theft, and further phishing pivots from a trusted internal sender. CISA added CVE-2024-11182 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation against MDaemon deployments.

Critical Impact
Remote attackers can execute arbitrary JavaScript in a victim's webmail browser session by sending a single crafted HTML email, enabling account takeover without credentials.

Affected Products

MDaemon Email Server versions prior to 24.5.1c
MDaemon Webmail (Worldclient) interface rendering HTML messages
All operating system deployments running vulnerable MDaemon builds

Discovery Timeline

2024-11-15 - CVE-2024-11182 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11182

Vulnerability Analysis

The vulnerability resides in how MDaemon's webmail component sanitizes HTML content in inbound email messages. The rendering pipeline fails to strip or neutralize JavaScript event handlers and script payloads embedded inside img tag attributes. When the message is opened, the browser parses the malformed HTML and executes attacker-supplied JavaScript within the origin of the webmail application.

Because the payload executes in the authenticated webmail context, the attacker inherits the victim's session cookies, DOM access, and mailbox permissions. This allows exfiltration of emails, contact lists, and calendar data, along with the ability to send outbound mail from the compromised account. The listing in the CISA KEV catalog indicates confirmed real-world exploitation.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. MDaemon's HTML sanitizer does not filter dangerous attributes or JavaScript URIs from img elements before rendering the message body in the webmail client. Attribute-based script vectors bypass the allowlist that filters top-level <script> blocks.

Attack Vector

Exploitation requires no authentication on the attacker side and only minimal user interaction: the victim opens the malicious email in the MDaemon webmail interface. The vulnerability manifests when the HTML body is rendered, so preview panes that auto-render HTML expand the attack surface. Attackers can chain the primitive to steal session tokens via document.cookie access or issue authenticated requests to the mail API on behalf of the victim.

No public proof-of-concept code has been released, and no exploit is available in Exploit-DB. Refer to the MDaemon Release Notes for vendor-supplied technical detail on the fixed sanitization logic.

Detection Methods for CVE-2024-11182

Indicators of Compromise

Inbound HTML emails containing img tags with onerror, onload, or javascript: handlers in attribute values.
Unexpected outbound email activity, forwarding rule creation, or mailbox rule modifications from webmail user accounts.
Webmail session activity originating from unfamiliar IP addresses or user agents shortly after a suspicious message is opened.

Detection Strategies

Inspect mail transport logs for HTML messages containing script-invoking attribute patterns in image elements before delivery.
Monitor MDaemon webmail access logs for anomalous XHR or fetch requests to internal mail endpoints made outside of normal user workflows.
Correlate mailbox rule changes, credential resets, and mass-forward events with recent HTML email opens by the affected user.

Monitoring Recommendations

Enable verbose logging on MDaemon SMTP and webmail components and forward events to a centralized SIEM for retention and correlation.
Alert on any new auto-forward or filter rules created within minutes of a user opening an external HTML email.
Track version banner strings across all MDaemon hosts to identify unpatched instances still below 24.5.1c.

How to Mitigate CVE-2024-11182

Immediate Actions Required

Upgrade all MDaemon Email Server instances to version 24.5.1c or later without delay.
Reset passwords and invalidate active webmail sessions for any user who opened suspicious HTML mail before patching.
Review mailbox rules, forwarding configurations, and sent-items folders for signs of post-exploitation activity.

Patch Information

MDaemon Technologies fixed the sanitization defect in MDaemon Email Server 24.5.1c. Details of the release are published in the MDaemon Release Notes. The vulnerability is tracked in the CISA Known Exploited Vulnerabilities Catalog, and U.S. federal civilian agencies are required to remediate under BOD 22-01 timelines.

Workarounds

Disable HTML rendering in the webmail client and force plain-text display until the patch is applied.
Restrict webmail access to trusted networks via IP allowlisting or VPN enforcement to reduce attacker reach.
Deploy a Content Security Policy (CSP) at the reverse proxy in front of the webmail interface to block inline script execution.

bash

# Verify installed MDaemon version on Windows host
reg query "HKLM\SOFTWARE\WOW6432Node\Alt-N Technologies\MDaemon" /v Version

# Example nginx reverse proxy header to enforce CSP for webmail
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; img-src 'self' data:;" always;