CVE-2024-30476: PowerStore Manager XSS Vulnerability

CVE-2024-30476 Overview

CVE-2024-30476 is a stored Cross-Site Scripting (XSS) vulnerability affecting Dell PowerStore Manager. A remote authenticated attacker with low privileges can inject malicious script content that is persistently stored by the application. When other users render the affected interface, the script executes in their browser context.

The flaw is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation). Successful exploitation requires user interaction and results in a scope change, impacting both confidentiality and integrity of the victim's session within PowerStore Manager.

Critical Impact
Authenticated low-privileged attackers can execute arbitrary JavaScript in other users' browsers, enabling session hijacking, credential theft, and unauthorized actions performed in the context of higher-privileged PowerStore Manager users.

Affected Products

Dell PowerStore Family (PowerStore Manager interface)
See Dell Security Update DSA-2024-225 for specific affected versions

Discovery Timeline

2026-06-16 - CVE-2024-30476 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30476

Vulnerability Analysis

The vulnerability resides in the PowerStore Manager web interface. The application fails to properly neutralize user-supplied input before storing it and rendering it back to users in subsequent HTTP responses. This allows an authenticated attacker to embed JavaScript payloads into fields that are later rendered as part of management views.

Because the payload is stored server-side, any user who navigates to the affected view triggers the injected script. The CVSS vector indicates a scope change, meaning the executed script affects resources beyond the vulnerable component itself, such as the victim's browser session and any cross-component data accessible from PowerStore Manager.

The impact includes execution of attacker-controlled JavaScript in administrator browsers, theft of session tokens, forced API calls under the victim's identity, and defacement of the management UI. User interaction is required because the payload only fires when a victim views the affected page.

Root Cause

The root cause is missing or insufficient output encoding when rendering attacker-controlled content stored by the PowerStore Manager. The application stores raw user input and reflects it into the HTML response without contextual escaping for the HTML, attribute, or JavaScript contexts where the data is placed.

Attack Vector

An authenticated low-privileged user submits a crafted payload through an input field exposed by PowerStore Manager. The payload is persisted by the backend. When another user, typically an administrator, loads the view that displays this stored content, the browser parses and executes the embedded script. The attacker leverages the victim's authenticated session to perform actions or exfiltrate data.

No verified public proof-of-concept code is available for CVE-2024-30476. Refer to the Dell Security Update DSA-2024-225 for vendor technical details.

Detection Methods for CVE-2024-30476

Indicators of Compromise

Unexpected <script>, onerror, onload, or javascript: tokens stored in PowerStore Manager configuration fields, object names, or descriptions.
PowerStore Manager audit log entries showing low-privileged accounts modifying fields immediately followed by administrator session anomalies.
Outbound HTTP requests from administrator workstations to unfamiliar domains shortly after accessing PowerStore Manager.

Detection Strategies

Inspect PowerStore Manager input fields and stored objects for HTML or JavaScript fragments that should not exist in operational data.
Correlate authenticated PowerStore Manager activity from low-privileged users with subsequent administrator browser anomalies, such as unexpected session token use or API calls.
Monitor browser-side telemetry for script execution originating from PowerStore Manager URLs that does not match known application behavior.

Monitoring Recommendations

Enable and forward PowerStore Manager audit logs to a centralized logging platform for review and retention.
Alert on administrator account API actions that occur outside of expected change windows or originate from unusual user-agent strings.
Track new or modified objects in PowerStore Manager and flag entries containing HTML control characters such as <, >, or &#.

How to Mitigate CVE-2024-30476

Immediate Actions Required

Apply the Dell patch documented in DSA-2024-225 to all PowerStore appliances.
Review and audit existing PowerStore Manager accounts, removing unnecessary low-privileged users who can write to stored fields.
Inspect stored configuration data for residual XSS payloads and sanitize affected entries.

Patch Information

Dell has released fixed versions of PowerStore as documented in Dell Security Advisory DSA-2024-225. Administrators should consult the advisory to identify the appropriate fixed release for their PowerStore model and upgrade accordingly.

Workarounds

Restrict PowerStore Manager access to a dedicated administrative network segment and enforce strict access control lists.
Require administrators to use isolated browsers or jump hosts when accessing PowerStore Manager, reducing the value of stolen session tokens.
Enforce least privilege on PowerStore Manager accounts so that fewer users can write content to fields rendered to other users.

bash

# Example: restrict access to PowerStore Manager via firewall ACL
# Replace placeholders with your environment values
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -d <powerstore_mgmt_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -d <powerstore_mgmt_ip> -j DROP