CVE-2024-52583: WesHacks Website XSS Vulnerability

CVE-2024-52583 Overview

CVE-2024-52583 affects the WesHacks GitHub repository, which hosts the official source code for the Muweilah Wesgreen Hackathon competition website. The schedule.html page referenced scripts from Leostop, a third-party site distributing a malicious injected JavaScript file delivered alongside Bootstrap and jQuery loads. The injected code reportedly creates two JavaScript files on the client and exhibits behavior consistent with tracking malware. The repository maintainers removed all references to Leostop on 17 November 2024 in commit 93dfb83. The flaw is categorized under [CWE-494: Download of Code Without Integrity Check].

Critical Impact
Visitors loading the affected schedule.html page executed untrusted third-party JavaScript in their browser context, enabling potential tracking, session compromise, or follow-on payload delivery.

Affected Products

WesHacks repository (DefinetlyNotAI/WesHacks)
Website/schedule.html prior to commit 93dfb83
WesHacks site versions published before 17 November 2024

Discovery Timeline

2024-11-17 - Maintainers removed references to Leostop in commit 93dfb83
2024-11-18 - CVE-2024-52583 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52583

Vulnerability Analysis

The WesHacks website loaded JavaScript dependencies, including jQuery and Bootstrap, from external resources tied to the Leostop domain. Because the page did not validate the integrity of these scripts, the browser executed whatever content the remote host returned. According to the advisory, the injected script created two additional JavaScript files in the page context and is suspected of acting as tracking malware. Any user who visited schedule.html before the fix unknowingly executed adversary-controlled code with full access to the page DOM, cookies, and storage scoped to the WesHacks origin.

Root Cause

The root cause is the inclusion of untrusted third-party JavaScript without integrity verification, matching [CWE-494: Download of Code Without Integrity Check]. The HTML referenced scripts hosted under attacker-influenced infrastructure and omitted Subresource Integrity (SRI) attributes, so the browser had no mechanism to detect tampering or substitution.

Attack Vector

Exploitation requires a user to visit the vulnerable schedule.html page. The attacker controls or compromises the upstream script host and serves modified JavaScript to every visitor. User interaction is limited to loading the page, after which the malicious code runs automatically in the browser. The scope changes because injected JavaScript can reach beyond the original component and act on behalf of the user across the WesHacks site.

text

# Patch in Website/schedule.html (commit ea5a411)
 </section>
 
 <!-- jQuery -->
-<script src="js/jquery-3.4.1.min.js" type="text/javascript"></script>
+<script src="https://code.jquery.com/jquery-3.6.0.min.js"></script>
 <!-- Bootstrap JS -->
 <script src="js/bootstrap.js" type="text/javascript"></script>
 <!-- Custom JS -->

Source: GitHub commit ea5a411

Detection Methods for CVE-2024-52583

Indicators of Compromise

Outbound browser requests to Leostop-associated domains originating from WesHacks page sessions
Presence of two unexpected JavaScript files written or loaded by schedule.html in browser session data
Local copies of js/jquery-3.4.1.min.js in WesHacks deployments cloned before commit 93dfb83

Detection Strategies

Audit forks and mirrors of DefinetlyNotAI/WesHacks for the pre-patch schedule.html and any reference to Leostop
Scan web proxy and DNS logs for connections to third-party script hosts referenced by the vulnerable page
Inspect browser-side telemetry for unauthorized script element creation tied to the affected origin

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to surface unexpected script sources on hackathon and event sites
Track web server access logs for visits to schedule.html from cloned deployments still serving the unpatched asset
Add the Leostop domain pattern to threat intelligence watchlists until provenance is fully understood

How to Mitigate CVE-2024-52583

Immediate Actions Required

Update any WesHacks deployment to commit 93dfb83 or later, which removes all Leostop references
Delete cached copies of the affected schedule.html and the bundled js/jquery-3.4.1.min.js from web roots and CDNs
Notify users who visited the site before 17 November 2024 to clear site data and review browser sessions

Patch Information

The fix is delivered through commits 93dfb83 and ea5a411. The patch removes the local jquery-3.4.1.min.js reference and replaces it with the official code.jquery.com CDN URL. Full advisory details are in the GitHub Security Advisory GHSA-462m-5c66-4pmh.

Workarounds

Strip all <script> tags pointing to Leostop from local copies of schedule.html if patching is delayed
Block the suspicious script host at the network or DNS layer to prevent the browser from retrieving the payload
Add Subresource Integrity (integrity="sha384-...") attributes and a strict CSP script-src directive to all third-party script tags

bash

# Example CSP header restricting script sources to trusted CDNs
add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://code.jquery.com https://cdn.jsdelivr.net; object-src 'none'; base-uri 'self'";