CVE-2024-12393

What it actually does

Unsanitized status messages rendered via JavaScript allow injection of arbitrary script content into user sessions.

Why it matters to the business

Attackers could hijack user sessions, steal data, or deface sites, increasing support costs and eroding trust; low EPSS and no KEV listing reduce immediate urgency but the two-year publication window means unpatched sites remain exposed.

How an attack unfolds

An attacker supplies crafted input that becomes a status message; when the page renders the message through JavaScript without proper sanitization, the injected script executes in victims' browsers.

How to fix it

Upgrade Drupal Core to 10.2.11 or later, 10.3.9 or later, or 11.0.8 or later; the fix is included in commit 3712d59414f556474f990a503c3f7c295f8c719f.

How to confirm the fix worked

Verify installed version is at or above the fixed releases, then test status message rendering paths with known XSS test vectors to confirm sanitization occurs before JavaScript execution.

Typical attack path

1. Identify a Drupal site accepting user-controlled input that surfaces as a status message
2. Craft payload containing executable script that bypasses existing sanitization
3. Trigger the status message display for targeted or all users
4. Harvest cookies, tokens, or perform actions on behalf of authenticated victims

How to detect it

Review web server and application logs for status message entries containing script tags, event handlers, or encoded JavaScript; inspect rendered page source for unexpected script execution in status regions.

What your security team should do

• Apply the listed Drupal upgrades within the next maintenance window
• Audit custom modules that generate status messages for similar sanitization gaps
• Enable Content-Security-Policy headers as a defense-in-depth measure
• Monitor EPSS trend; reassess if score rises above 0.1