CVE-2024-50859
📋 TL;DR
This vulnerability allows attackers to execute malicious JavaScript in victims' browsers when they upload improperly formatted CSV files to GestioIP's ip_import_acl_csv endpoint. The vulnerability affects all users of GestioIP v3.5.7 who have access to the CSV import functionality.
💻 Affected Systems
- GestioIP
📦 What is this software?
Gestioip by Gestioip
⚠️ Risk & Real-World Impact
Worst Case
Attacker steals session cookies, performs actions as the victim user, or exfiltrates sensitive data from the GestioIP interface.
Likely Case
Attacker performs session hijacking or steals authentication tokens to gain unauthorized access to the IP management system.
If Mitigated
Limited impact with proper input validation and output encoding, potentially only affecting the specific user who uploaded the malicious file.
🎯 Exploit Status
Exploitation requires user interaction (uploading a malicious CSV file). Proof of concept available in GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://www.gestioip.net
Restart Required: No
Instructions:
Check vendor website for security updates. No official patch information available at this time.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to sanitize CSV file content before processing
Implement proper input validation in ip_import_acl_csv endpoint
Content Security Policy
allImplement CSP headers to restrict script execution
Add Content-Security-Policy header to web server configuration
🧯 If You Can't Patch
- Restrict CSV import functionality to trusted users only
- Implement web application firewall rules to detect and block XSS payloads in file uploads
🔍 How to Verify
Check if Vulnerable:
Test by uploading a CSV file containing XSS payloads like <script>alert('XSS')</script> and checking if it's reflected in the responseCheck Version:
Check GestioIP version in web interface or configuration filesVerify Fix Applied:
Verify that uploaded CSV content is properly sanitized and not reflected in HTML responses📡 Detection & Monitoring
Log Indicators:
- Unusual CSV file uploads with script tags or JavaScript code
- Multiple failed import attempts with malformed content
Network Indicators:
- HTTP requests to ip_import_acl_csv endpoint with suspicious file content
- Outbound connections to external domains following CSV uploads
SIEM Query:
source="web_server" AND (uri="*ip_import_acl_csv*" AND (content="*<script>*" OR content="*javascript:*"))