Full Report
XSS (Cross-site Scripting) vulnerability (CVE-2024-10385) has been found in DirectAdmin Evolution Skin software.
Analysis Summary
# Vulnerability: Stored XSS in DirectAdmin Evolution Skin Ticket System
## CVE Details
- CVE ID: CVE-2024-10385
- CVSS Score: Not explicitly provided (Severity implied as High due to potential for Admin context execution)
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation - XSS)
## Affected Systems
- Products: DirectAdmin Evolution Skin
- Versions: All before 1.668
- Configurations: Applies to the ticket management system within the skin.
## Vulnerability Description
A Stored Cross-Site Scripting (XSS) vulnerability exists within the ticket management system of DirectAdmin Evolution Skin. A low-privileged user can inject and store malicious JavaScript code into the ticket system fields. When an administrator views the compromised ticket, the stored script executes with the administrator's privileges, potentially leading to unauthorized actions, including command execution on the server.
## Exploitation
- Status: PoC available (Implied by confirmation of vulnerability disclosure/fix; not explicitly stated as exploited in the wild)
- Complexity: Low (Requires low-privileged user access to submit a malicious ticket, then an admin must view it)
- Attack Vector: Network (via web interface submission)
## Impact
- Confidentiality: High (Admin context allows access to sensitive data)
- Integrity: High (Admin context allows modification of system state/data)
- Availability: Medium to High (Potential for system disruption or service compromise via command execution)
## Remediation
### Patches
- DirectAdmin Evolution Skin version 1.668 and later resolves this vulnerability.
### Workarounds
- The article does not specify any workarounds; immediate patching is recommended. Limiting the ability for low-privileged users to create or interact with tickets could serve as a temporary measure until patching is complete.
## Detection
- Indicators of compromise: Unexpected administrative actions initiated immediately following an administrator viewing a user-submitted ticket.
- Detection methods and tools: Monitoring ticket submission forms for unusual or encoded input strings. Reviewing administrative session activity immediately after ticket viewing.
## References
- Vendor advisories: DirectAdmin (Implicitly via release of version 1.668)
- Relevant links - defanged:
- hXXps://cert.pl/en/news/
- hXXps://www.cve.org/CVERecord?id=CVE-2024-10385