Reflected Cross-Site Scripting Vulnerability in 2ClickPortal

CVE-2024-5961 describes a reflected cross-site scripting (XSS) vulnerability affecting 2ClickPortal versions 7.2.31 through 7.6.4. The flaw resides within the application's search functionality, specifically in the 'string' parameter of the '/szukaj/' endpoint. By injecting malicious JavaScript into this parameter, an attacker can cause the application to reflect the script back to the user's browser, where it executes in the context of the user's session. This vulnerability is rated with a CVSS 5.3 (Medium) and requires passive user interaction, such as clicking a crafted link, to achieve exploitation. As a proof-of-concept exploit is now public, it is critical for administrators to audit instances of 2ClickPortal and apply necessary patches to mitigate the risk of session hijacking or further client-side exploitation.

Impact

Successful exploitation of CVE-2024-5961 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser of a victim who clicks a malicious link. This can lead to unauthorized actions performed on behalf of the user, theft of session cookies, or redirection to malicious sites. The vulnerability affects a specific range of 2ClickPortal versions, making any installation within the 7.2.31 to 7.6.4 version window susceptible to this attack vector.

Recommendation

• Upgrade 2ClickPortal instances to a version outside the affected range (7.2.31-7.6.4).
• Implement Content Security Policy (CSP) headers on the web server to restrict the execution of unauthorized inline scripts.
• Deploy detection rules to identify anomalous HTTP requests targeting the '/szukaj/' endpoint with character sequences commonly used for XSS injection.