CVE-2024-35321
📋 TL;DR
MyNET up to v26.08 contains a reflected cross-site scripting (XSS) vulnerability in the msgtipo parameter. This allows attackers to inject malicious scripts that execute in victims' browsers when they visit specially crafted URLs. Organizations using MyNET versions up to v26.08 are affected.
💻 Affected Systems
- MyNET
📦 What is this software?
Mynet by Airc
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on user systems.
Likely Case
Session hijacking, credential theft, or defacement of web pages through script injection.
If Mitigated
Limited impact with proper input validation, output encoding, and Content Security Policy (CSP) headers in place.
🎯 Exploit Status
Reflected XSS typically requires user interaction (clicking malicious link) but is easy to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v26.09 or later
Vendor Advisory: https://www.airc.pt/solucoes-servicos/solucoes?segment=MYN
Restart Required: Yes
Instructions:
1. Download latest MyNET version from vendor. 2. Backup current installation. 3. Apply patch/upgrade to v26.09+. 4. Restart MyNET services. 5. Verify fix.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to sanitize msgtipo parameter input.
# Add input validation in application code for msgtipo parameter
Web Application Firewall (WAF)
allDeploy WAF rules to block XSS payloads in msgtipo parameter.
# Configure WAF to filter <script> tags and JavaScript in msgtipo
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to limit script execution.
- Use network segmentation to isolate MyNET from critical systems and limit access.
🔍 How to Verify
Check if Vulnerable:
Test by injecting <script>alert('XSS')</script> into msgtipo parameter and checking if script executes.Check Version:
Check MyNET admin interface or configuration files for version number.Verify Fix Applied:
After patching, repeat XSS test; script should not execute and input should be properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual msgtipo parameter values containing script tags or JavaScript code in web logs.
Network Indicators:
- HTTP requests with msgtipo parameter containing suspicious payloads.
SIEM Query:
web_logs msgtipo CONTAINS "<script>" OR "javascript:"