CVE-2024-49505: openSUSE MirrorCache XSS Vulnerability

CVE-2024-49505 Overview

CVE-2024-49505 is a reflected cross-site scripting (XSS) vulnerability in openSUSE Tumbleweed MirrorCache. The flaw allows attackers to execute arbitrary JavaScript in a victim's browser through unsanitized input in the REGEX and P request parameters. MirrorCache is the redirector service that distributes openSUSE download traffic across mirror servers, making the application a high-traffic target for phishing and session theft attacks. The issue affects all MirrorCache releases before version 1.083 and is categorized under [CWE-79]. Successful exploitation requires user interaction, typically by convincing a target to click a crafted URL.

Critical Impact
Attackers can execute arbitrary JavaScript in the victim's browser context, enabling session theft, credential harvesting, and phishing against openSUSE mirror users.

Affected Products

openSUSE MirrorCache versions before 1.083
openSUSE Tumbleweed distributions running vulnerable MirrorCache instances
Any mirror redirector deployment based on the affected MirrorCache release

Discovery Timeline

2024-11-13 - CVE-2024-49505 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-49505

Vulnerability Analysis

MirrorCache reflects the values of the REGEX and P query parameters back into HTML responses without proper output encoding. An attacker who controls these parameter values can inject arbitrary HTML and JavaScript that executes in the context of the MirrorCache origin. Because the injection is reflected, exploitation requires a target to visit a crafted link. Once triggered, the injected script runs with the same privileges as the MirrorCache web application, allowing attackers to read cookies, tamper with page content, and initiate authenticated requests. This vulnerability falls under the Cross-Site Scripting (XSS) category and is tracked as [CWE-79].

Root Cause

The root cause is missing or insufficient neutralization of user-supplied input during web page generation. The application accepts the REGEX and P parameters from HTTP requests and embeds them directly in server-rendered HTML. No contextual output encoding is applied before the values reach the browser, so metacharacters such as <, >, and " retain their HTML meaning and enable script execution.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker crafts a URL pointing at a vulnerable MirrorCache endpoint with malicious payloads in the REGEX or P query parameter. The target must click the link or be redirected to it, at which point the server reflects the payload into the rendered page. The injected script then runs in the origin of the MirrorCache instance. See the SUSE Bug Report for CVE-2024-49505 for advisory details.

Detection Methods for CVE-2024-49505

Indicators of Compromise

HTTP requests to MirrorCache endpoints containing <script>, onerror=, javascript:, or URL-encoded equivalents inside the REGEX or P parameters
Referer headers pointing at attacker-controlled domains that direct users to MirrorCache URLs with long, unusual query strings
Web server access logs showing spikes in requests with abnormally long or heavily encoded REGEX and P values

Detection Strategies

Deploy web application firewall (WAF) rules that block or flag HTML and JavaScript metacharacters in the REGEX and P query parameters
Review MirrorCache access logs for reflected XSS payload patterns, including %3Cscript%3E, %22onerror%3D, and document.cookie
Correlate outbound traffic from browsers that visited MirrorCache with unexpected destinations that could indicate session token exfiltration

Monitoring Recommendations

Enable continuous logging of full query strings on MirrorCache front-end proxies and forward logs to a centralized analytics platform
Alert on anomalous request volumes to MirrorCache endpoints originating from a small set of referrers
Monitor browser Content Security Policy (CSP) violation reports to identify attempted script injection against MirrorCache pages

How to Mitigate CVE-2024-49505

Immediate Actions Required

Upgrade MirrorCache to version 1.083 or later on all openSUSE Tumbleweed hosts running the redirector
Restart the MirrorCache service after upgrade and validate that the REGEX and P parameters are now properly encoded
Rotate any session tokens or administrative credentials that may have been exposed while a vulnerable release was in production

Patch Information

The vulnerability is resolved in MirrorCache 1.083. Administrators should apply the fixed release from the openSUSE package repositories. Refer to the SUSE Bug Report for CVE-2024-49505 for the authoritative advisory and package availability.

Workarounds

Place a WAF or reverse proxy in front of MirrorCache and drop requests where REGEX or P contain HTML or JavaScript metacharacters
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Set the HttpOnly and Secure flags on session cookies to reduce the impact of successful script execution

bash

# Example nginx rule to block suspicious REGEX and P parameters
if ($args ~* "(REGEX|P)=[^&]*(<|%3C|script|onerror|javascript:)") {
    return 403;
}