Skip to content
Threat Feed
Subscribe
high advisory

OpenPetra: Unauthenticated XSS in serverMFinDev.asmx (CVE-2024-40509)

OpenPetra version 2023.02 contains an unauthenticated XSS vulnerability in the serverMFinDev.asmx component that allows attackers to steal user session cookies.

CVE search metadata

CVE search record: CVE-2024-40509. Severity: high. CVSS: 7.3. EPSS: 0.78%. KEV: no. Product: OpenPetra (2023.02). Brief: OpenPetra: Unauthenticated XSS in serverMFinDev.asmx (CVE-2024-40509). Brief link: https://feed.craftedsignal.io/briefs/2026-10-openpetra-xss/

Triage facts

Revision 1
Applicability
OpenPetra (2023.02)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
3 public sources
Freshness
Revision 1Oct 25, 16:45 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B3Likely

OpenPetra version 2023.02 is vulnerable to an unauthenticated cross-site scripting (XSS) attack via the 'tab' parameter in the 'serverMFinDev.asmx' web service. An attacker can craft a malicious URL to inject arbitrary JavaScript, which executes when an authenticated user interacts with the application interface, specifically by hovering over the left index item. Successful exploitation allows for the theft of sensitive session cookies.

Impact

Successful exploitation results in the theft of session cookies from authenticated users, potentially leading to full account takeover. The vulnerability is rated at CVSS 7.3.

Recommendation

  • Identify all instances of OpenPetra 2023.02 within the environment.
  • Apply the latest available security patches or upgrades provided by the OpenPetra project to remediate CVE-2024-40509.
  • Implement Content Security Policy (CSP) headers to mitigate the impact of reflected XSS attacks.
  • Hunt for exploitation attempts targeting the 'serverMFinDev.asmx' endpoint in web access logs.

Immediate actions

Scan network for vulnerable OpenPetra 2023.02 instances

IT Operations 24h

Threat Hunt

Inspect web server logs for high frequency of attempts on /serverMFinDev.asmx

T1189 high high confidence hunt now

Data: Web server access logs

Mitigations

Upgrade OpenPetra to a patched version if available, or restrict access to serverMFinDev.asmx

immediate IT Operations

CVE-2024-40509

Detection coverage 1

Detect CVE-2024-40509 Exploitation Attempt

high

Detects exploitation attempts against the serverMFinDev.asmx endpoint by monitoring for URI query parameters containing suspicious script-related characters and the tab parameter.

sigma tactics: initial_access techniques: T1189 sources: webserver

Detection queries are available on the platform. Get full rules →