{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3agoanotheranother_redis_desktop_manager/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:goanother:another_redis_desktop_manager:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.6,"id":"CVE-2024-23998"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Another Redis Desktop Manager (\u003c= 1.6.6)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Goanother"],"content_html":"\u003cp\u003eCVE-2024-23998 describes a vulnerability in Another Redis Desktop Manager (\u0026lt;= 1.6.6) where improper sanitization of the 'font_faq' configuration string allows for Cross-Site Scripting (XSS). Because the application leverages the 'v-html' directive and enables 'nodeIntegration' within its Electron framework, an attacker who successfully injects malicious JavaScript into the application's resources - such as by distributing a trojanized installer or modifying the application's configuration files - can achieve Remote Code Execution (RCE) with the privileges of the application when the user interacts with the affected UI element.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains the distribution files for Another Redis Desktop Manager.\u003c/li\u003e\n\u003cli\u003eAttacker modifies the 'en.js' file within the application resources to inject malicious JavaScript into the 'font_faq' string.\u003c/li\u003e\n\u003cli\u003eAttacker repackages the application into a trojanized installer.\u003c/li\u003e\n\u003cli\u003eUser installs the malicious software (often bypassing security warnings).\u003c/li\u003e\n\u003cli\u003eUser launches the application and navigates to the Settings menu.\u003c/li\u003e\n\u003cli\u003eUser hovers the mouse cursor over the Font Family help icon.\u003c/li\u003e\n\u003cli\u003eThe application renders the 'font_faq' string via 'v-html', executing the injected JavaScript.\u003c/li\u003e\n\u003cli\u003eThe malicious script uses the enabled 'nodeIntegration' to execute arbitrary operating system commands, such as 'calc.exe'.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution on the host machine running Another Redis Desktop Manager. The severity is high (CVSS 9.6) as it permits full system compromise, data exfiltration, or persistence depending on the attacker's payload.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all installations of Another Redis Desktop Manager and ensure they are upgraded to a version later than 1.6.6.\u003c/li\u003e\n\u003cli\u003eImplement strict application control policies to prevent the execution of unauthorized or tampered binaries, specifically targeting the installation directory of Electron-based applications.\u003c/li\u003e\n\u003cli\u003eUtilize endpoint security tools to monitor for unexpected process-spawning behavior from 'electron.exe' or the main application process.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T03:09:50Z","date_published":"2026-10-27T03:09:50Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-23998/","summary":"Another Redis Desktop Manager versions up to 1.6.6 are vulnerable to remote code execution via XSS in the font_faq setting field due to unsafe v-html usage and enabled nodeIntegration in its Electron configuration.","title":"Another Redis Desktop Manager: Local code execution via XSS (CVE-2024-23998)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-23998/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:goanother:another_redis_desktop_manager:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}