CVE-2024-2598
📋 TL;DR
CVE-2024-2598 is a cross-site scripting (XSS) vulnerability in AMSS++ version 4.31 that allows remote attackers to inject malicious scripts via user-controlled input in the /amssplus/modules/book/main/select_send_2.php endpoint. This could enable session cookie theft when authenticated users visit specially crafted URLs. Organizations using AMSS++ 4.31 are affected.
💻 Affected Systems
- AMSS++
📦 What is this software?
Amss\+\+ by Amss\+\+ Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full administrative access to the AMSS++ system, and potentially compromise the entire application and connected systems.
Likely Case
Attackers steal user session cookies to hijack accounts, access sensitive data, and perform unauthorized actions within the application.
If Mitigated
Limited impact with proper input validation, output encoding, and session security controls in place.
🎯 Exploit Status
Exploitation requires social engineering to trick authenticated users into clicking malicious URLs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in available references
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
Restart Required: No
Instructions:
Check vendor advisory for updates. If no patch exists, implement workarounds or upgrade to a fixed version when available.
🔧 Temporary Workarounds
Input Validation and Output Encoding
allImplement server-side input validation and output encoding for all user-controlled parameters in the vulnerable endpoint.
Web Application Firewall (WAF) Rules
allDeploy WAF rules to block XSS payloads targeting the /amssplus/modules/book/main/select_send_2.php endpoint.
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to mitigate script execution.
- Use HttpOnly and Secure flags for session cookies to prevent theft via JavaScript.
🔍 How to Verify
Check if Vulnerable:
Check if AMSS++ version is 4.31 and the /amssplus/modules/book/main/select_send_2.php endpoint exists and accepts user input.Check Version:
Check AMSS++ configuration files or admin interface for version information.Verify Fix Applied:
Test the vulnerable endpoint with XSS payloads to ensure they are properly sanitized or blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to /amssplus/modules/book/main/select_send_2.php with suspicious parameters containing script tags or JavaScript code.
Network Indicators:
- HTTP requests to the vulnerable endpoint with encoded or obfuscated XSS payloads in parameters.
SIEM Query:
source="web_logs" AND uri="/amssplus/modules/book/main/select_send_2.php" AND (param CONTAINS "<script>" OR param CONTAINS "javascript:")