CVE-2024-2211: Getgophish Gophish XSS Vulnerability

CVE-2024-2211 Overview

CVE-2024-2211 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Gophish version 0.12.1, an open-source phishing simulation framework maintained by Getgophish. An attacker with access to the admin panel can inject a malicious JavaScript payload into the campaign menu. The payload executes when the campaign is later removed from the menu, triggering script execution in the administrator's browser session.

The vulnerability requires user interaction to trigger the stored payload and can lead to session compromise, credential theft, or unauthorized actions within the Gophish admin panel.

Critical Impact
Attackers can persistently store JavaScript within the Gophish admin panel, hijacking administrator sessions and pivoting to compromise phishing campaign data or connected systems.

Affected Products

Getgophish Gophish 0.12.1
Deployments using the affected admin panel campaign menu functionality
Any Gophish instance built on the vulnerable codebase without applied fixes

Discovery Timeline

2024-03-06 - CVE-2024-2211 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2211

Vulnerability Analysis

The flaw resides in Gophish's admin panel, specifically within the campaign menu rendering logic. Gophish stores user-supplied campaign metadata without sufficient output encoding. When the campaign is removed from the menu, the application re-renders the affected element and executes the stored script in the administrator's browser context.

Because the payload lives in server-side storage, every administrator who triggers the deletion workflow can be affected. The scope-changed nature of the flaw means script execution can influence resources beyond the vulnerable component's origin, such as authenticated API endpoints within the same admin session.

Root Cause

The root cause is improper neutralization of user-controllable input during web page generation, classified under [CWE-79]. Gophish accepts campaign-related input from authenticated users and reflects that content into the admin UI without applying context-appropriate HTML or JavaScript encoding. The vulnerable render path is invoked during the campaign removal event, which is why the payload triggers on deletion rather than on creation.

Attack Vector

Exploitation proceeds through the following high-level steps:

An attacker with authenticated access to the Gophish admin panel creates or edits a campaign containing a crafted JavaScript payload in a stored field surfaced by the campaign menu.
The payload persists in the Gophish backend datastore.
When an administrator removes the campaign from the menu, the admin UI renders the stored value and the browser executes the injected script.
The script runs with the privileges of the authenticated administrator, enabling session token theft, admin API abuse, or modification of phishing campaigns.

See the INCIBE Security Notice on XSS Vulnerability for additional technical context.

Detection Methods for CVE-2024-2211

Indicators of Compromise

Campaign records containing HTML tags such as <script>, <img onerror=...>, or javascript: URIs stored in campaign name or description fields.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after campaign deletion actions.
Anomalous admin API calls originating from a session immediately following interaction with the campaign menu.

Detection Strategies

Inspect the Gophish database for stored campaign fields containing HTML or script markup and review web server access logs for suspicious payload submission requests.
Deploy content security policy (CSP) violation reporting to surface inline script execution attempts within the admin panel.
Correlate administrator authentication events with unusual DOM-triggered network activity captured by endpoint browser telemetry.

Monitoring Recommendations

Enable verbose audit logging for campaign creation, modification, and deletion events within Gophish.
Monitor administrator workstations for browser process anomalies and unexpected script execution originating from the admin panel origin.
Alert on new admin account creation, API key generation, or SMTP profile changes that occur in temporal proximity to campaign management actions.

How to Mitigate CVE-2024-2211

Immediate Actions Required

Restrict admin panel access to trusted networks using firewall rules or a reverse proxy with IP allowlisting.
Audit existing campaigns in the Gophish datastore and remove any records containing HTML or JavaScript markup in user-controllable fields.
Rotate administrator credentials and API keys if suspicious campaign entries or unexpected admin activity are identified.
Limit the number of accounts with admin panel access and enforce strong authentication for those accounts.

Patch Information

At the time of the NVD publication, no vendor advisory URL or fixed version is referenced in the CVE record for Gophish 0.12.1. Administrators should monitor the Gophish project for updated releases and apply any subsequent security fixes. Refer to the INCIBE Security Notice on XSS Vulnerability for advisory guidance.

Workarounds

Place the Gophish admin panel behind a web application firewall (WAF) with rules that block common XSS payload patterns in campaign management endpoints.
Serve the admin panel with a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Operate Gophish in isolated environments dedicated to authorized security testing and prohibit exposure to the public internet.
Instruct administrators to avoid interacting with unfamiliar or unexpected campaign entries until they are validated and cleaned.

bash

# Example nginx snippet enforcing CSP and admin IP allowlisting for Gophish
location /admin/ {
    allow 10.0.0.0/24;
    deny all;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;
    add_header X-Content-Type-Options "nosniff" always;
    proxy_pass https://127.0.0.1:3333;
}