CVE-2024-28741: NorthStar C2 XSS Vulnerability

CVE-2024-28741 Overview

CVE-2024-28741 is a stored cross-site scripting (XSS) vulnerability in EginDemirbilek NorthStar C2 v1, an open-source command and control (C2) framework hosted on GitHub. The flaw resides in the login.php component and allows an unauthenticated remote attacker to inject persistent JavaScript that executes in the browser of any operator who views the login interface. Because NorthStar C2 operators can issue commands to connected agents directly from the web UI, an attacker who lands stored script in the panel can pivot from XSS to remote code execution on every agent the victim operator controls [CWE-79].

Critical Impact
Pre-authentication stored XSS in the NorthStar C2 login page allows attackers to execute arbitrary code on connected C2 agents by hijacking operator sessions.

Affected Products

EginDemirbilek NorthStar C2 v1
NorthStar C2 teamserver web panel (login.php)
Connected NorthStar C2 agents controlled through a compromised operator session

Discovery Timeline

2024-04-06 - CVE-2024-28741 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28741

Vulnerability Analysis

NorthStar C2 is a post-exploitation framework where operators authenticate to a PHP-based web panel to task implants. The login.php endpoint accepts attacker-controlled input that is later rendered in the panel without proper output encoding. The injected payload is stored server-side and executed when an operator opens the affected view in the browser.

Because the same panel issues commands to agents through authenticated requests, JavaScript executing under the operator's origin can forge command requests. This converts a client-side scripting flaw into a server-side execution primitive on every implant linked to the hijacked session. User interaction is required, but the trigger is opening a routine page that operators visit during normal use.

Root Cause

The root cause is missing input sanitization and output encoding in the authentication-facing component. Attacker-supplied data reaches the rendered HTML context with HTML and script delimiters intact, satisfying the conditions for stored XSS classified under [CWE-79].

Attack Vector

An unauthenticated attacker sends crafted input to login.php to plant a malicious payload. When an operator later views the panel, the stored script executes in the operator's browser context. The script then issues authenticated agent-tasking requests to the teamserver, instructing connected implants to run arbitrary commands on compromised hosts.

The vulnerability mechanism and a working proof of concept are documented publicly. See the Chebuya Blog CVE Analysis and the Packet Storm NorthStar C2 Exploit advisory for technical details. The original project is available at the GitHub NorthStarC2 Repository.

Detection Methods for CVE-2024-28741

Indicators of Compromise

Unexpected POST requests to login.php containing HTML tags, <script> fragments, or JavaScript event handlers in form fields
Outbound command execution from NorthStar C2 agents that does not correlate with legitimate operator activity
New or modified records in NorthStar C2 backend storage containing encoded script payloads
Operator browser sessions issuing rapid, scripted tasking requests immediately after viewing the login or dashboard page

Detection Strategies

Inspect web server access logs for login.php requests containing XSS markers such as <script, onerror=, javascript:, or encoded equivalents
Apply web application firewall rules that flag HTML and JavaScript metacharacters in unauthenticated request bodies
Correlate agent command execution events with operator UI activity to identify automated tasking driven by injected scripts

Monitoring Recommendations

Monitor endpoints that host NorthStar C2 panels for anomalous PHP request patterns and persistent script content
Alert on browsers loading the NorthStar C2 panel from non-operator IP ranges or off-hours sessions
Track child processes spawned by NorthStar C2 agent binaries on managed hosts for unexpected command-line activity

How to Mitigate CVE-2024-28741

Immediate Actions Required

Take NorthStar C2 v1 panels offline or restrict access to trusted management networks until a fixed build is deployed
Rotate operator credentials and invalidate active panel sessions after confirming the panel was not exposed to untrusted input
Review agent command history for tasks that do not map to authorized operator activity and isolate affected hosts

Patch Information

No official vendor patch is referenced in the NVD record for CVE-2024-28741. NorthStar C2 is an open-source project; consult the GitHub NorthStarC2 Repository for the latest commits and apply input sanitization and contextual output encoding to the login.php component before redeploying.

Workarounds

Place the NorthStar C2 panel behind a VPN or IP allowlist so unauthenticated internet users cannot reach login.php
Deploy a web application firewall rule set that strips or rejects HTML and JavaScript content in login form parameters
Enforce a strict Content Security Policy on the panel to limit inline script execution and reduce the impact of stored payloads
Discontinue use of NorthStar C2 v1 in environments where the panel cannot be hardened, and migrate to a maintained alternative

bash

# Example: restrict NorthStar C2 panel access with nginx allowlisting
location /login.php {
    allow 10.0.0.0/24;       # trusted operator subnet
    deny  all;
    proxy_pass http://127.0.0.1:8080;
}