CVE-2024-8750: I-doit Pro XSS Vulnerability

CVE-2024-8750 Overview

CVE-2024-8750 is a reflected Cross-Site Scripting (XSS) vulnerability affecting i-doit pro version 28. The flaw stems from insufficient sanitization of eight user-controlled request parameters: id, lang, mNavID, name, pID, treeNode, type, and view. An unauthenticated attacker can craft a malicious URL that, when opened by an authenticated user, executes arbitrary JavaScript in the victim's browser session. The primary impact is theft of session details belonging to authenticated users of the IT documentation platform. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can hijack authenticated i-doit pro sessions and access sensitive IT asset documentation by luring users to click crafted links.

Affected Products

i-doit pro version 28
Deployments exposing the i-doit pro web interface to untrusted networks
Environments where administrators or operators browse links from external sources

Discovery Timeline

2024-09-12 - CVE-2024-8750 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8750

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the i-doit pro web application. The application accepts several request parameters and reflects their values into rendered HTML without proper encoding or filtering. An attacker who injects JavaScript payloads into any of the affected parameters causes the browser to execute the script in the context of the authenticated i-doit session.

Because i-doit pro serves as a central Configuration Management Database (CMDB) and IT documentation platform, session compromise exposes inventory, network diagrams, credentials metadata, and other operational data. User interaction is required, which reduces the exploitability but not the severity of the resulting session theft.

Root Cause

The root cause is missing output encoding and input sanitization on eight parameters processed by server-side handlers: id, lang, mNavID, name, pID, treeNode, type, and view. These values pass through to HTML rendering without being neutralized against script contexts, matching the pattern described by CWE-79.

Attack Vector

Exploitation is network-based and requires no privileges but does require a victim to click a crafted link. A typical attack chain involves the attacker embedding a JavaScript payload into a vulnerable parameter, distributing the link through phishing or a watering-hole page, and receiving exfiltrated cookies or session identifiers when the victim's authenticated browser executes the payload. The scope changes because injected script runs in the security context of the i-doit application. No verified public proof-of-concept code is available. Refer to the INCIBE Security Notice on Vulnerabilities for further technical context.

Detection Methods for CVE-2024-8750

Indicators of Compromise

Web server access logs containing <script>, javascript:, onerror=, or URL-encoded equivalents (%3Cscript%3E) within the id, lang, mNavID, name, pID, treeNode, type, or view parameters.
Unexpected outbound HTTP requests from user browsers to attacker-controlled domains shortly after i-doit pro navigation.
Anomalous session activity in i-doit audit logs, such as concurrent sessions for a single user from disparate IP addresses.

Detection Strategies

Deploy Web Application Firewall (WAF) signatures that inspect the eight named parameters for HTML tags, event handlers, and script-context characters.
Correlate reverse-proxy or load-balancer logs with browser telemetry to identify reflected payloads returned to authenticated sessions.
Alert on referrer patterns showing external origins driving traffic to i-doit URLs that contain suspicious query strings.

Monitoring Recommendations

Enable verbose HTTP request logging on the i-doit pro reverse proxy and retain logs for correlation.
Monitor authentication and session events for reuse of session identifiers across new user agents or geolocations.
Track email gateway and browser proxy events for URLs referencing the i-doit hostname combined with encoded script payloads.

How to Mitigate CVE-2024-8750

Immediate Actions Required

Restrict access to the i-doit pro interface to trusted internal networks or VPN-authenticated users until a fixed version is confirmed.
Enforce a strict Content Security Policy (CSP) that disallows inline script execution on the i-doit application origin.
Instruct operators and administrators to avoid clicking i-doit links received from external or untrusted sources.

Patch Information

No vendor patch URL is referenced in the NVD entry. Administrators running i-doit pro version 28 should consult the vendor and the INCIBE Security Notice on Vulnerabilities for the latest remediation guidance and upgrade paths.

Workarounds

Configure a WAF rule to reject requests where the vulnerable parameters contain <, >, ", ', or event-handler substrings such as onerror, onload, or onclick.
Set the session cookie attributes HttpOnly, Secure, and SameSite=Strict to reduce the value of stolen cookies to script-based exfiltration.
Shorten session lifetimes and require re-authentication for sensitive CMDB operations to limit the window for session hijacking.

bash

# Example ModSecurity rule blocking script payloads in vulnerable i-doit parameters
SecRule ARGS:id|ARGS:lang|ARGS:mNavID|ARGS:name|ARGS:pID|ARGS:treeNode|ARGS:type|ARGS:view \
    "@rx (?i)(<script|javascript:|onerror=|onload=|onclick=)" \
    "id:1008750,phase:2,deny,status:403,log,\
    msg:'CVE-2024-8750 i-doit pro reflected XSS attempt blocked'"