CVE-2024-51026 - Cross Site Scripting (XSS) Vulnerability in NetAdmin IAM

Description

The NetAdmin IAM system (version 4.0.30319) presents a Cross Site Scripting (XSS) vulnerability in the /BalloonSave.ashx endpoint, where it is possible to inject a malicious payload in the Content= field. Any authenticated user can exploit this vulnerability by inserting a script in the "Content" field of a request within the described endpoint. This script will be executed whenever the vulnerable page is refreshed.

Vulnerability Details

• Type: Cross Site Scripting (XSS)
• Affected Version: 4.0.30319

CVSS Score and Attack Vectors

• Base Score (CVSS): 7.3
• Attack Vectors: CVSS Calculator

CVSS Vector	Description
AV	N (Network)
AC	L (Low)
PR	L (Low)
UI	R (Required)
S	U (Unchanged)
C	H (High)
I	H (High)
A	N (None)

Vulnerable Endpoint

• URL: https://netadmin.mysystem/BalloonSave.ashx
• Affected Parameter: Content=

Solution

Fix Status

• Under Approval: The fix for this vulnerability is currently in the approval phase.

Mitigation Recommendations

Until the official fix is made available by the vendor, it is recommended to:

1. Request a version update from the system vendor.
2. Implement additional security measures, such as restrictions on user data input, to mitigate the risk of XSS injection.

Mitigation References

• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
• CWE-116: Improper Encoding or Escaping of Output
• CWE-159: Improper Handling of Insufficient Privileges

---

For more details on this vulnerability or technical assistance in implementing mitigation measures, contact the vendor's security support.