Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-49379 — CVE-2024-49379 PoC | Kitploit
Tools/GitHubGitHub/ohdudeoknice/cve-2024-49379
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & Education
GitHubohdudeoknice/cve-2024-49379

CVE-2024-49379

CVE-2024-49379 PoC

View Repository
11 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Proof of Concept (PoC) for CVE-2024-49379

This repository contains a Python-based Proof of Concept (PoC) for a critical vulnerability identified in UmbrelOS. The vulnerability allows for Cross-Site Scripting (XSS), which can escalate to Remote Code Execution (RCE) under specific conditions.

Overview

  • CVE: CVE-2024-49379
  • Severity: Critical
  • Vulnerability Type: Cross-Site Scripting (XSS) leading to Remote Code Execution (RCE)
  • Affected Software: UmbrelOS versions prior to 1.2.2
  • Discoverer: Peter Stöckli (@p-) and the GitHub Security Lab team

The issue was identified in the login functionality, specifically in how the redirect query parameter is handled. A malicious payload can be injected, allowing unauthorized JavaScript execution in the context of a user's session.

Details

The vulnerability exists due to improper input validation and unchecked flows from the redirect query parameter into sensitive browser sink functions, such as window.location.href. This flaw permits an attacker to inject arbitrary JavaScript into a victim's session. Under certain conditions, this can be escalated to server-side command execution via the Umbrel terminal WebSocket interface.

Key Exploitation Vector:

  1. A victim is tricked into accessing a malicious link containing the crafted payload in the parameter.
Download Tool
redirect
  • The payload executes upon login, enabling the attacker to access sensitive session data or perform further actions.

    • Proof of Concept (PoC)

    This repository includes a Python script (poc.py) to generate a malicious URL containing the exploit payload. The script is intended for educational and authorized security testing purposes only.

    Usage

    1. Clone the repository:

      root@kitploit:~
      git clone https://github.com/your-org-or-username/CVE-2024-49379.git
cd CVE-2024-49379

    2. Run the script:

      root@kitploit:~
      python3 poc.py

    3. Share the generated URL with a test environment to observe the impact of the vulnerability.

    Mitigation

    The vulnerability has been patched in UmbrelOS version 1.2.2. All users are strongly advised to upgrade to the latest version. Additionally, secure coding practices, such as input validation and safe redirects, should be employed to prevent similar issues.

    Fixed Version:

    • UmbrelOS 1.2.2

    Recommendations:

    • Upgrade immediately to the patched version.
    • Review all query parameter handling and validate inputs rigorously.
    • Implement Content Security Policy (CSP) headers to mitigate XSS risks.

    Acknowledgments

    • Discovered By: Peter Stöckli (@p-) and the GitHub Security Lab team
    • PoC Adapted for Python By: S1REN

    Disclaimer

    This PoC is provided for educational and authorized testing purposes only. Unauthorized use or distribution of this code may result in legal consequences. Always obtain explicit permission from the system owner before conducting any testing or vulnerability exploitation.

    License

    This repository is released under the MIT License. By using this repository, you agree to adhere to ethical guidelines and applicable laws.