CVE-2024-22397 Overview
CVE-2024-22397 is a stored cross-site scripting (XSS) vulnerability in the SonicOS SSLVPN portal. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An authenticated attacker holding firewall admin privileges can inject and persist arbitrary JavaScript that executes in the browsers of other users accessing the portal.
SonicWall published advisory SNWLID-2024-0005 documenting the issue. The vulnerability affects the SSLVPN component of SonicOS and requires both high privileges and user interaction to trigger the payload.
Critical Impact
An admin-level attacker can store JavaScript in the SSLVPN portal, hijack sessions of subsequent visitors, escalate access across the trust boundary, and pivot into internal networks reachable through the appliance.
Affected Products
- SonicWall SonicOS SSLVPN portal
- SonicWall firewall appliances running vulnerable SonicOS builds
- Refer to SonicWall advisory SNWLID-2024-0005 for the full list of affected versions
Discovery Timeline
- 2024-03-14 - CVE-2024-22397 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-22397
Vulnerability Analysis
The SSLVPN portal in SonicOS renders administrator-controlled input without sufficient output encoding. When an admin submits data through affected portal fields, the application stores that content and later returns it in HTML responses to other users. Browsers parse the injected <script> payload as legitimate portal code and execute it in the victim's session context.
Because the flaw scope crosses a trust boundary between the admin plane and the SSLVPN user plane, the injected script runs against portal visitors including remote-access users. Attackers can steal session cookies, forge authenticated requests, redirect users to attacker-controlled hosts, or deliver secondary payloads.
Root Cause
The root cause is missing or incomplete output encoding of stored input before it is embedded in generated HTML. The application trusts admin-supplied strings and writes them to the DOM without HTML-entity encoding or context-aware sanitization. This is a textbook [CWE-79] stored XSS pattern.
Attack Vector
Exploitation requires an authenticated admin session on the SonicOS management interface. The attacker submits a crafted payload through a vulnerable SSLVPN portal input field, which is then persisted server-side. Any user who subsequently loads the affected portal page executes the payload in their browser. The user-interaction requirement means the victim must visit the poisoned page, but the SSLVPN portal is a routine destination for remote workers.
No verified public exploit code is available. Refer to the SonicWall Vulnerability Advisory SNWLID-2024-0005 for vendor-supplied technical details.
Detection Methods for CVE-2024-22397
Indicators of Compromise
- Unexpected <script>, onerror=, or javascript: strings stored in SSLVPN portal configuration fields
- SSLVPN portal responses containing HTML or JavaScript that was not authored by the administrator
- Outbound requests from portal user browsers to unfamiliar domains immediately after portal login
- New or modified admin sessions preceding changes to SSLVPN portal branding, bookmarks, or messages
Detection Strategies
- Inspect SSLVPN portal configuration for HTML tags or JavaScript keywords in fields intended to hold plain text
- Review SonicOS audit logs for admin configuration changes to SSLVPN portal objects and correlate against change-management records
- Alert on HTTP responses from the SSLVPN portal that contain script sinks such as document.cookie or eval(
Monitoring Recommendations
- Forward SonicOS management and SSLVPN logs to a central SIEM and retain admin activity for post-incident review
- Monitor for anomalous admin logins including unusual source IPs, off-hours activity, and impossible-travel events
- Track browser-side errors and Content Security Policy violations reported by portal users
How to Mitigate CVE-2024-22397
Immediate Actions Required
- Apply the fixed SonicOS firmware identified in SonicWall advisory SNWLID-2024-0005 to all affected appliances
- Rotate credentials for all firewall admin accounts and any SSLVPN users who may have loaded the portal since the last known-good state
- Audit SSLVPN portal configuration objects and remove any unexpected HTML or script content
- Enforce multi-factor authentication on all SonicOS administrative accounts
Patch Information
SonicWall has released fixed SonicOS builds addressing CVE-2024-22397. Consult the SonicWall Vulnerability Advisory SNWLID-2024-0005 for the specific fixed versions applicable to your appliance model and firmware branch, and follow the vendor's upgrade procedure.
Workarounds
- Restrict SonicOS administrative access to a dedicated management network or trusted IP allow-list
- Limit the number of accounts holding admin privileges and use role-based accounts for routine changes
- Disable the SSLVPN portal on appliances where remote-access VPN is not required until patching is complete
- Require administrators to use hardened, dedicated workstations when configuring SSLVPN portal content
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
