CVE-2024-33979: Janobe Credit Card XSS Vulnerability

CVE-2024-33979 Overview

CVE-2024-33979 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Janobe PayPal, Credit Card, and Debit Card Payment version 1.0. The flaw resides in the /index.php endpoint, where the q, arrival, departure, and accomodation parameters are reflected into HTTP responses without proper sanitization. An attacker who crafts a malicious URL and convinces a victim to click it can execute arbitrary JavaScript in the victim's browser session. Successful exploitation can disclose session cookies, enable session hijacking, and allow interaction with the application under the victim's identity.

Critical Impact
Attackers can steal session cookies and perform actions on behalf of authenticated users in Janobe payment components by delivering a crafted URL.

Affected Products

Janobe PayPal 1.0
Janobe Credit Card 1.0
Janobe Debit Card Payment 1.0

Discovery Timeline

2024-08-06 - CVE-2024-33979 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-33979

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the Janobe payment components. The /index.php script accepts user-controlled input via four GET parameters: q, arrival, departure, and accomodation. These values are echoed back into the HTML response without output encoding or input filtering. An attacker can embed JavaScript payloads inside any of these parameters and deliver the URL through phishing, chat, or embedded links.

When the victim loads the crafted URL, the browser executes the injected script in the origin of the vulnerable application. The attacker can read document.cookie, exfiltrate session identifiers, modify the DOM, or trigger authenticated requests. Because payment components typically handle sensitive transactions, cookie theft can expose account state and purchase workflows.

Root Cause

The root cause is missing input validation and output encoding on user-supplied query string parameters in /index.php. The application concatenates untrusted values into HTML markup without applying context-appropriate escaping, which satisfies the conditions for reflected XSS defined in CWE-79.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker crafts a URL targeting /index.php with a JavaScript payload in one of the vulnerable parameters, for example q, arrival, departure, or accomodation. The victim must click the link while visiting the affected site. No authentication is required to craft the payload, but the impact increases when the victim holds an active session on the vulnerable application. Refer to the INCIBE Security Notice on Vulnerabilities for additional context.

Detection Methods for CVE-2024-33979

Indicators of Compromise

Web server access logs containing requests to /index.php with <script>, onerror=, javascript:, or URL-encoded equivalents in the q, arrival, departure, or accomodation parameters.
Outbound requests from user browsers to attacker-controlled domains immediately following access to the Janobe payment pages.
Unexpected session reuse from geographically distant IP addresses on the same account.

Detection Strategies

Deploy a web application firewall (WAF) ruleset that flags HTML and JavaScript syntax in GET parameters targeting the vulnerable endpoint.
Inspect HTTP referrers and user-agent patterns for anomalies associated with phishing campaigns delivering crafted URLs.
Correlate browser error telemetry and Content Security Policy (CSP) violation reports to surface injection attempts.

Monitoring Recommendations

Centralize web server and reverse proxy logs and alert on parameter values containing XSS signatures.
Monitor session cookie usage for concurrent sessions or sudden privilege changes.
Track outbound traffic from workstations to newly registered or low-reputation domains after visits to the payment application.

How to Mitigate CVE-2024-33979

Immediate Actions Required

Restrict public access to the vulnerable /index.php endpoint until a vendor patch is applied.
Deploy WAF rules that reject requests containing script tags or JavaScript handlers in the q, arrival, departure, and accomodation parameters.
Rotate active user session cookies and force reauthentication for all users of the payment components.

Patch Information

No vendor patch is referenced in the NVD entry for Janobe PayPal, Credit Card, or Debit Card Payment 1.0. Organizations should consult the INCIBE Security Notice on Vulnerabilities for the latest vendor guidance and consider replacing the affected components if no fixed version is released.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Set the HttpOnly and Secure flags on all session cookies to limit JavaScript access and transport exposure.
Apply server-side input validation and context-aware output encoding on all parameters reflected into HTML responses.

bash

# Example NGINX rule to block common XSS payloads on the vulnerable endpoint
location = /index.php {
    if ($args ~* "(<|%3C)script|javascript:|onerror=|onload=") {
        return 403;
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'";
    add_header X-XSS-Protection "1; mode=block";
}