CVE-2024-21328: Microsoft Dynamics 365 XSS Vulnerability

CVE-2024-21328 Overview

CVE-2024-21328 is a spoofing vulnerability in Microsoft Dynamics 365 Sales. The flaw is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation) and enables cross-site scripting behavior that supports spoofing attacks against authenticated users. An attacker with low privileges can craft content that, when rendered in a victim's browser, executes in the context of the Dynamics 365 application. Successful exploitation requires user interaction, such as clicking a malicious link. Microsoft published details in the Microsoft Security Update CVE-2024-21328 advisory.

Critical Impact
Attackers can spoof legitimate Dynamics 365 Sales content and impact confidentiality across a changed security scope, enabling credential theft and session abuse.

Affected Products

Microsoft Dynamics 365 (on-premises)
Microsoft Dynamics 365 Sales
Deployments matching cpe:2.3:a:microsoft:dynamics_365:*:*:*:*:on-premises:*:*:*

Discovery Timeline

2024-02-13 - CVE-2024-21328 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2024-21328

Vulnerability Analysis

The vulnerability arises from improper neutralization of user-supplied input within Dynamics 365 Sales web content. When an authenticated low-privilege user submits crafted input, the application renders it without adequate sanitization. A victim who interacts with the affected content triggers script execution in the browser context.

Because the scope changes on exploitation, the attacker's payload can reach resources beyond the vulnerable component. This produces spoofing conditions where a victim sees content that appears legitimate but is attacker-controlled. Attackers can harvest session material, redirect workflows, and manipulate sales records that users trust.

The EPSS score of 1.316% places this vulnerability in the 68th percentile for likelihood of exploitation activity.

Root Cause

The root cause is missing or insufficient output encoding on user-controllable fields within Dynamics 365 Sales. The application treats crafted input as trusted markup during rendering. This maps directly to [CWE-79], the standard classification for cross-site scripting weaknesses.

Attack Vector

The attack vector is network-based. An authenticated attacker with low privileges injects a payload into a Dynamics 365 Sales field or resource. The attacker then lures a legitimate user to view or interact with the affected surface. Execution proceeds in the victim's browser session under the Dynamics 365 origin, enabling spoofing of application content.

No verified public proof-of-concept code is available. Refer to the Microsoft Security Response Center advisory for exploitation prerequisites and vendor guidance.

Detection Methods for CVE-2024-21328

Indicators of Compromise

Unexpected <script> tags, event handlers, or encoded JavaScript stored in Dynamics 365 Sales record fields, notes, or attachments.
Anomalous outbound requests from user browsers to attacker-controlled domains originating from Dynamics 365 sessions.
Session token reuse from distinct IP addresses following a user's interaction with a suspicious Dynamics 365 record.

Detection Strategies

Inspect Dynamics 365 audit logs for record modifications by low-privilege accounts that inject HTML or script content into shared fields.
Correlate web application firewall alerts flagging script fragments in POST requests to Dynamics 365 endpoints with subsequent user access to those records.
Review browser Content Security Policy violation reports generated when the Dynamics 365 origin attempts to execute unexpected inline scripts.

Monitoring Recommendations

Enable and centralize Dynamics 365 activity logging for create, update, and share operations on customer-facing records.
Monitor authentication telemetry for token replay or impossible-travel patterns following user access to modified records.
Alert on privilege changes or export activity by accounts that recently viewed records edited by low-privilege users.

How to Mitigate CVE-2024-21328

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2024-21328 to all Dynamics 365 on-premises deployments.
Audit Dynamics 365 Sales records edited or created since February 2024 for stored script content and remove malicious payloads.
Reset sessions and force reauthentication for users who accessed suspected records during the exposure window.

Patch Information

Microsoft published the fix in the security update tracked at the Microsoft Security Update CVE-2024-21328 page. Administrators should consult the advisory for the specific build numbers applicable to their Dynamics 365 deployment and install the update through standard Microsoft update channels.

Workarounds

Restrict Dynamics 365 Sales record creation and modification permissions to trusted roles until patching completes.
Enforce a strict Content Security Policy on the Dynamics 365 origin to block inline script execution.
Require users to reauthenticate before performing sensitive sales operations to reduce the value of hijacked sessions.

bash

# Configuration example
# Review the MSRC advisory for the exact update package matching your Dynamics 365 build
# https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21328