Description

CVE-2024-10385 affects DirectAdmin Evolution Skin's ticket management system and is vulnerable to Cross-site Scripting (XSS). This vulnerability enables low-privileged users to inject malicious JavaScript code, which, when viewed by an administrator, could be executed with admin privileges, potentially leading to command execution. While the CVSS score is 0, the SOCRadar Vulnerability Risk Score (SVRS) is 30, indicating a moderate level of risk and necessitating attention.

Key Insights

• Impact: The vulnerability allows attackers to potentially gain administrative control over the system, enabling them to execute commands, steal sensitive data, or disrupt operations.
• Exploitation: This vulnerability is actively being exploited "in the wild" by attackers, highlighting the urgency of addressing it.
• Persistence: Once exploited, the malicious code can be stored and executed persistently, requiring continuous monitoring and remediation.
• Low Privilege Exploitation: The vulnerability's exploitation requires only low-privilege user access, increasing its potential reach and impact.

Mitigation Strategies

• Upgrade: Immediately upgrade to DirectAdmin Evolution Skin version 1.668 or later to patch the vulnerability.
• Input Validation: Implement robust input validation and sanitization mechanisms to prevent the injection of malicious scripts.
• Security Awareness Training: Educate users about the risks of XSS attacks and best practices for avoiding them.
• Security Monitoring: Continuously monitor the system for suspicious activity, including unusual login attempts, file changes, and network traffic.

Additional Information

For further information on CVE-2024-10385 or assistance with mitigating this vulnerability, users can use the "Ask to Analyst" feature, contact SOCRadar directly, or open a support ticket.