CVE-2024-52875: XSS
First published: Fri Jan 31 2025(Updated: )
An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is not properly sanitized before being used to generate a Location HTTP header in a 302 HTTP response. This can be exploited to perform Open Redirect or HTTP Response Splitting attacks, which in turn lead to Reflected Cross-Site Scripting (XSS). Remote command execution can be achieved by leveraging the upgrade feature in the admin interface.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GFI Software KerioControl | >=9.2.5<=9.4.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.bleepingcomputer.com/news/security/hackers-exploit-keriocontrol-firewall-flaw-to-steal-admin-csrf-tokens/
- https://karmainsecurity.com/hacking-kerio-control-via-cve-2024-52875
- http://seclists.org/fulldisclosure/2024/Dec/15
- https://www.bleepingcomputer.com/news/security/over-12-000-keriocontrol-firewalls-exposed-to-exploited-rce-flaw/
Frequently Asked Questions
What is the severity of CVE-2024-52875?
CVE-2024-52875 has a critical severity rating due to the potential for unauthorized access and exposure of sensitive data.
How do I fix CVE-2024-52875?
To fix CVE-2024-52875, update GFI Kerio Control to version 9.4.6 or later which addresses the vulnerability.
Who is affected by CVE-2024-52875?
All users of GFI Kerio Control versions 9.2.5 to 9.4.5 are affected by CVE-2024-52875.
What is the potential impact of CVE-2024-52875?
The potential impact of CVE-2024-52875 includes the risk of attackers manipulating HTTP responses to carry out malicious activities.
What pages are vulnerable in CVE-2024-52875?
The vulnerable pages in CVE-2024-52875 include /nonauth/addCertException.cs, /nonauth/guestConfirm.cs, and /nonauth/expiration.cs.
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2024-52875
- collector/nvd-api
- source/NVD
- agent/first-publish-date
- agent/type
- agent/description
- agent/last-modified-date
- agent/author
- agent/source
- agent/weakness
- agent/news-ai
- exploited/true
- agent/severity
- agent/references
- agent/event
- agent/trending
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/gfi
- canonical/gfi software keriocontrol