CVE-2024-37392
📋 TL;DR
A stored XSS vulnerability in SMSEagle software allows attackers to inject malicious JavaScript into SMS messages. When viewed in the web interface, this code executes in the victim's browser. This affects all SMSEagle installations running versions below 6.0.
💻 Affected Systems
- SMSEagle
📦 What is this software?
Smseagle by Smseagle
⚠️ Risk & Real-World Impact
Worst Case
Attacker could steal administrator credentials, hijack sessions, install backdoors, or pivot to internal networks if the SMSEagle device has network access.
Likely Case
Session hijacking, credential theft, or defacement of the SMSEagle web interface.
If Mitigated
Limited to interface manipulation without network access if proper network segmentation exists.
🎯 Exploit Status
Exploitation requires sending a malicious SMS to the device, which then must be viewed in the web interface. No authentication bypass needed for the XSS execution itself.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.0
Vendor Advisory: https://www.smseagle.eu/security-advisory/resolved-xss-in-smseagle-software-cve-2024-37392/
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Download SMSEagle version 6.0 from official vendor. 3. Upload firmware via web interface. 4. Apply update. 5. Reboot device.
🔧 Temporary Workarounds
Input Sanitization Filter
allImplement custom input validation to strip script tags from SMS messages before display
Not applicable - requires code modification
Content Security Policy
allImplement CSP headers to restrict script execution
Add 'Content-Security-Policy: script-src 'self'' to web server configuration
🧯 If You Can't Patch
- Restrict web interface access to trusted IP addresses only
- Disable SMS inbox viewing functionality in web interface if not required
🔍 How to Verify
Check if Vulnerable:
Check SMSEagle version via web interface: System > About. If version is below 6.0, system is vulnerable.Check Version:
Not applicable - version check done via web interfaceVerify Fix Applied:
After updating to version 6.0, verify version in System > About shows 6.0 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual SMS messages containing script tags or JavaScript code
- Multiple failed login attempts after SMS viewing
Network Indicators:
- Outbound connections from SMSEagle device to unexpected external IPs
- Unusual HTTP requests from SMSEagle web interface
SIEM Query:
source="smseagle" AND (message="*<script>*" OR message="*javascript:*")