CVE-2024-28804: Italtel I-mcs NFV XSS Vulnerability

CVE-2024-28804 Overview

CVE-2024-28804 is a stored Cross-Site Scripting (XSS) vulnerability affecting Italtel i-MCS NFV version 12.1.0-20211215. Attackers can inject malicious script payloads through HTTP POST requests, which the application then stores and renders in user browsers. The flaw is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

The vulnerability requires user interaction to trigger script execution but does not require prior authentication. Exploitation can lead to session hijacking, credential theft, or unauthorized actions within the management interface.

Critical Impact
Authenticated administrators visiting affected pages may execute attacker-controlled JavaScript, exposing session tokens and enabling unauthorized actions against the i-MCS NFV management plane.

Affected Products

Italtel i-MCS NFV 12.1.0-20211215
CPE: cpe:2.3:a:italtel:i-mcs_nfv:12.1.0-20211215
Network Functions Virtualization management components

Discovery Timeline

2024-07-29 - CVE-2024-28804 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28804

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Italtel i-MCS NFV web management interface. The application accepts user-supplied input via HTTP POST requests without applying sufficient output encoding or input sanitization. The unsanitized payload is persisted in the application backend and later rendered into HTML responses served to other users.

When an authenticated user navigates to a page containing the injected content, the browser interprets the attacker payload as legitimate JavaScript. Execution occurs in the security context of the i-MCS NFV application origin. This grants the attacker access to cookies, local storage, and any privileges held by the victim session.

The attack vector is network-based and requires user interaction to trigger script execution. The scope is changed because injected scripts can act beyond the vulnerable component into the user's browser context.

Root Cause

The root cause is improper neutralization of input during web page generation. The application fails to encode special HTML characters such as <, >, ", and ' when reflecting stored values into responses. No Content Security Policy (CSP) appears to mitigate execution of inline scripts.

Attack Vector

An unauthenticated or low-privileged attacker submits a crafted POST request containing JavaScript payloads in fields the application stores. When an administrator or other user accesses the page rendering that field, the browser executes the attacker-controlled script. Typical payloads target session cookies, perform CSRF-style actions, or pivot into deeper administrative functions.

No public proof-of-concept exploit code has been released for this CVE. See the Gruppo TIM Red Team Overview for the disclosing party reference.

Detection Methods for CVE-2024-28804

Indicators of Compromise

HTTP POST requests to i-MCS NFV endpoints containing <script>, javascript:, onerror=, or onload= patterns in form parameters
Stored database fields containing HTML tags or encoded script payloads in user-modifiable records
Unexpected outbound requests from administrator browsers to attacker-controlled domains
Anomalous session token usage from IP addresses outside normal administrative ranges

Detection Strategies

Inspect web server access logs for POST bodies containing common XSS payload signatures targeting the i-MCS NFV interface
Deploy a Web Application Firewall (WAF) rule set tuned to flag script tags and event handler attributes in request parameters
Review stored configuration and user-input fields for HTML or JavaScript content that should not contain markup

Monitoring Recommendations

Enable verbose application logging on the i-MCS NFV management interface to capture POST payloads for audit
Monitor administrator session behavior for unusual API calls following page loads
Alert on Content-Type or Referer anomalies indicative of cross-origin script execution

How to Mitigate CVE-2024-28804

Immediate Actions Required

Restrict access to the i-MCS NFV management interface to trusted administrative networks using firewall or VPN controls
Audit all stored user-input fields for existing malicious payloads and purge any HTML or script content
Require administrators to use dedicated browsers or browser profiles when accessing the management console

Patch Information

No vendor advisory or patch URL is currently listed in the NVD record for CVE-2024-28804. Contact Italtel support directly to confirm availability of a fixed release for i-MCS NFV beyond version 12.1.0-20211215. Reference the Gruppo TIM Red Team Overview for disclosure context.

Workarounds

Deploy a reverse proxy or WAF in front of i-MCS NFV configured to strip or encode HTML metacharacters in POST parameters
Enforce a strict Content Security Policy header at the proxy layer to block inline script execution
Limit administrative accounts to least-privilege roles to reduce the impact of a successful session compromise
Disable or restrict any web interface features not required for operational use

bash

# Example NGINX reverse proxy header hardening
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer" always;