CVE-2024-6398: Skyhighsecurity SWG Information Disclosure

CVE-2024-6398 Overview

CVE-2024-6398 is an information disclosure vulnerability in Skyhigh Security Secure Web Gateway (SWG). The flaw affects SWG versions 12.x prior to 12.2.10 and 11.x prior to 11.2.24. Attackers can exploit a Same Origin Policy (SOP) bypass in browsers to leak information stored on customizable block pages to third-party websites. The scope of disclosure depends on how administrators have customized those block pages. The issue is tracked under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Third-party websites can read data rendered on customized SWG block pages under specific browser conditions, exposing any sensitive content administrators embedded in those pages.

Affected Products

Skyhigh Security Secure Web Gateway 12.x prior to 12.2.10
Skyhigh Security Secure Web Gateway 11.x prior to 11.2.24
Deployments with customized block pages containing sensitive content

Discovery Timeline

2024-07-15 - CVE-2024-6398 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6398

Vulnerability Analysis

Skyhigh Security Secure Web Gateway presents customizable block pages to end users when policy rules deny access to a requested URL. Administrators can embed contextual information in these pages, such as user identifiers, policy names, requested URLs, or category labels. The vulnerability allows a third-party website to bypass the browser Same Origin Policy under specific conditions and read content rendered inside these block pages. The severity of any disclosure depends entirely on what information administrators chose to expose within the customized block page template. Deployments that rely on default templates disclose minimal information, while deployments enriched with user or session data face broader exposure risk.

Root Cause

The root cause is an SOP bypass condition in browsers when interacting with SWG block pages. The block page response does not sufficiently prevent cross-origin reads in certain scenarios, enabling attacker-controlled origins to observe data intended only for the requesting user. The weakness maps to [CWE-200].

Attack Vector

An attacker hosts a malicious page that triggers a request known to be blocked by the target's SWG policy. The browser renders the SWG block page, and the attacker's page uses the SOP bypass technique to read fields from that block page. Complementary controls such as URL categorization and Global Threat Intelligence (GTI) reduce risk by blocking access to uncategorized or high-risk sites that would host the exploit content. Full technical details are documented in the Trellix Knowledge Base Article.

Detection Methods for CVE-2024-6398

Indicators of Compromise

Outbound requests from user browsers to uncategorized or newly registered domains immediately following blocked page events.
Repeated forced navigation attempts to URLs known to trigger SWG block responses from a single referrer origin.
SWG logs showing high volumes of blocked requests originating from third-party embedded content or iframes.

Detection Strategies

Correlate SWG block-page events with subsequent third-party requests in web proxy and DNS telemetry.
Inspect referrer chains in SWG access logs for external origins that repeatedly trigger blocked responses.
Alert on JavaScript patterns in browser telemetry that attempt cross-origin reads against internal gateway responses.

Monitoring Recommendations

Ingest SWG access and block logs into a centralized analytics platform for cross-source correlation.
Monitor for changes to block-page templates that introduce user-, session-, or policy-specific data.
Track browser versions across the fleet to identify endpoints running clients susceptible to SOP bypass conditions.

How to Mitigate CVE-2024-6398

Immediate Actions Required

Upgrade Skyhigh Security Secure Web Gateway to version 12.2.10 or later on the 12.x branch.
Upgrade Skyhigh Security Secure Web Gateway to version 11.2.24 or later on the 11.x branch.
Audit customized block-page templates and remove sensitive fields such as usernames, session tokens, or internal policy identifiers.
Confirm that URL categorization and Global Threat Intelligence policies are enforced to block uncategorized and high-risk destinations.

Patch Information

Skyhigh Security addresses CVE-2024-6398 in Secure Web Gateway 12.2.10 and 11.2.24. Refer to the Trellix Knowledge Base Article for release notes and upgrade guidance. No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Workarounds

Restrict block-page content to static, non-sensitive text until upgrades are deployed.
Enforce strict URL categorization and GTI policies to block third-party sites that could host exploit code.
Keep browser fleets updated to versions that enforce Same Origin Policy correctly against gateway responses.

bash

# Configuration example
# Verify running SWG version prior to upgrade
ssh admin@swg-appliance "mwg-version --show"

# Confirm URL filtering and GTI are enabled in the active policy
# via the SWG administrator UI: Policy > Web Filtering > URL Filter
# Ensure: 'Block Uncategorized URLs' = enabled
# Ensure: 'Global Threat Intelligence' = enabled