CVE-2024-28741

What it actually does

The flaw is a network-reachable cross-site scripting issue in the login.php component of NorthStar C2 v1. An unauthenticated remote attacker can craft content or a link that, when opened by a user, causes attacker-controlled JavaScript to run in the victim’s browser in the context of the affected application. Because that script executes with the application’s origin privileges, it can read page content, steal session material if exposed to JavaScript, perform authenticated actions as the victim, alter the login flow, capture credentials entered into the page, or chain into broader compromise of the C2 administration interface. The CVSS 8.8 rating, high EPSS score of 0.78158, and weaponized exploit maturity indicate a high likelihood of practical exploitation despite the issue not currently appearing in CISA KEV.

Why it matters to the business

Successful exploitation can compromise administrative access to a command-and-control management application, exposing credentials, operator sessions, configuration data, and potentially the ability to issue actions through the application as a trusted user. For organizations running affected components, this can lead to loss of control over security tooling or lab infrastructure, unauthorized command execution through the management plane, data exposure, and operational disruption. The issue has been public for 856 days and is assessed as weaponized with a high EPSS probability, so unpatched exposed instances should be treated as high-risk even though it is not listed in KEV and is not flagged as ransomware-associated.

How an attack unfolds

An attacker first identifies an exposed NorthStar C2 v1 login interface or finds a way to deliver a crafted URL or login-related request to a likely administrator or operator. The attacker embeds malicious script content into a parameter or input path processed by login.php without proper output encoding. When the victim visits the crafted login page, follows the link, or interacts with the manipulated login workflow, the browser executes the attacker’s script under the affected site’s origin. The script can then harvest credentials typed into the page, steal accessible session tokens, make background requests to perform actions as the victim, or redirect the user through a convincing authentication flow. If the compromised account has administrative capability, the attacker may use the application’s own functionality to alter configuration, create persistence, access managed assets, or issue commands indirectly through the platform. Where the vulnerability is tracked through Chromium-based distribution packages, attackers may also rely on vulnerable browser builds to increase the reliability or impact of client-side exploitation chains.

How to fix it

Upgrade or replace affected software immediately. For NorthStar C2, move off v1 or apply the vendor-provided fix that corrects output encoding and input handling in login.php. If no maintained fixed release is available, remove the application from exposure, restrict access to trusted administrative networks, and place it behind strong authentication such as VPN or identity-aware proxy controls. Implement contextual output encoding for all user-controlled values rendered in HTML, JavaScript, attributes, and URLs; validate and normalize login parameters; add anti-CSRF protections for state-changing actions; and deploy a restrictive Content-Security-Policy that disallows inline script execution. Treat existing sessions as potentially exposed and rotate administrator credentials and session secrets after remediation. Where this issue is being tracked through OS package inventory for Chromium-based clients, ensure minimum fixed package levels are installed: Debian 11/12/13 chromium at 93.0.4577.82-1 or later, and Ubuntu 18.04 LTS chromium-browser at 92.0.4515.159-0ubuntu0.18.04.1 or later.

How to confirm the fix worked

Confirm no exposed NorthStar C2 v1 login.php endpoint remains reachable from untrusted networks. Verify the installed application version or code branch includes the vendor fix and that login.php safely encodes reflected values. Test with benign XSS validation strings and confirm they are rendered as text rather than executed. Review response headers for a restrictive Content-Security-Policy and secure cookie attributes such as HttpOnly, Secure, and SameSite. Validate package state on Linux systems with package manager queries such as apt-cache policy chromium or apt-cache policy chromium-browser and confirm installed versions meet or exceed the fixed versions. Re-scan externally and internally after patching to confirm the vulnerable interface is not detected.

Typical attack path

1. Discover an internet-accessible or internally reachable NorthStar C2 v1 login.php endpoint.
2. Craft a malicious login URL, form submission, or injected value that causes JavaScript to be reflected or rendered by login.php.
3. Deliver the crafted link or lure to an authenticated or soon-to-authenticate user, such as an operator or administrator.
4. Victim opens the link or interacts with the affected login page, triggering script execution in the application’s browser origin.
5. Attacker-controlled script captures credentials, reads page data, steals accessible session material, or sends authenticated background requests.
6. Attacker uses the captured session or forced actions to access the C2 interface and perform administrative operations.
7. Attacker establishes persistence, modifies configuration, accesses sensitive data, or abuses the platform’s command capabilities.

How to detect it

Investigate web server, reverse proxy, WAF, application, identity provider, endpoint, and DNS/proxy logs for evidence of exploitation. Focus on requests to login.php containing HTML tags, JavaScript event handlers, javascript: URIs, heavily URL-encoded content, base64-like blobs, or references to unfamiliar external domains. Review authentication logs for failed or unusual login attempts followed by successful access, logins from new geographies or user agents, rapid administrative actions after a login-page visit, new user creation, configuration changes, or unexplained command/task activity. On endpoints used by administrators, review browser history, cached pages, downloads, EDR telemetry, clipboard access, suspicious child processes spawned from browsers, and outbound web requests immediately after visiting the affected login page. If session theft is suspected, correlate application session identifiers, source IP changes within the same session, impossible travel, and actions performed without corresponding user activity. Because no named threat actor is provided, detection should emphasize generic weaponized XSS patterns and post-exploitation use of valid sessions.

• /login.php
• login.php?
• <script
• %3Cscript
• </script>
• %3C%2Fscript%3E
• javascript:
• javascript%3A
• onerror=
• onload=
• onclick=
• document.cookie
• document.domain
• localStorage
• sessionStorage
• eval(
• atob(
• btoa(
• fetch(
• XMLHttpRequest
• new Image(
• navigator.sendBeacon
• window.location
• location.href
• srcdoc=
• iframe
• %3Ciframe
• img src=x
• alert(
• prompt(
• confirm(
• String.fromCharCode
• fromCharCode
• setTimeout(
• setInterval(
• base64,
• data:text/html
• data:text/javascript
• /login.php?redirect=
• /login.php?url=
• /login.php?next=
• /login.php?return=
• /login.php?message=
• /login.php?error=

What your security team should do

• Prioritize remediation of any internet-facing NorthStar C2 v1 login.php endpoints because exploit maturity is weaponized and EPSS is high.
• Immediately restrict access to the login interface to trusted administrative networks or VPN users until the application is patched or retired.
• Patch or upgrade affected application components; where tracked through distro inventory, update Debian chromium to 93.0.4577.82-1 or later and Ubuntu 18.04 chromium-browser to 92.0.4515.159-0ubuntu0.18.04.1 or later.
• Rotate passwords, API keys, session secrets, and administrative tokens associated with the affected application after patching.
• Invalidate active sessions for all users of the affected application.
• Review web access logs for suspicious login.php requests containing script-like input, encoded JavaScript, external callback URLs, or credential-harvesting behavior.
• Deploy or tune WAF and reverse-proxy rules to block script tags, JavaScript URI handlers, event-handler attributes, and encoded equivalents in login parameters.
• Add browser-side hardening where possible, including Content-Security-Policy, HttpOnly cookies, and SameSite cookies.
• Hunt for suspicious outbound connections from administrator browsers or from the application host following login.php access.
• If compromise is suspected, perform a full review of application configuration, user accounts, audit logs, and any managed agents or downstream systems controlled through the platform.