CVE-2024-47093

What it actually does

Improper neutralization of user-supplied input allows injection and execution of arbitrary JavaScript in the context of other users' browsers.

Why it matters to the business

Attackers can steal session tokens, perform actions on behalf of logged-in operators, or deliver malware through the monitoring interface, leading to unauthorized access to network visibility data and potential lateral movement.

How an attack unfolds

An attacker crafts a malicious payload containing script tags or event handlers and submits it through any unsanitized input field or URL parameter in Nagvis. When another user loads the affected page, the browser executes the injected script, enabling theft of cookies or redirection to attacker-controlled sites.

How to fix it

Upgrade Nagvis to the version containing commit 30e71e8167d17a1828e7da71d6942f6fb36478cd (equivalent to release 1.9.42 or newer). If immediate upgrade is not possible, restrict untrusted input sources and enforce strict Content-Security-Policy headers as a temporary control.

How to confirm the fix worked

Confirm the deployed commit hash matches 30e71e8167d17a1828e7da71d6942f6fb36478cd or later; review release notes for the 1.9.42 XSS fix; test previously vulnerable input fields with benign payloads to verify they are now escaped.

Typical attack path

1. Identify an input vector (URL parameter, form field, or configuration value) that is reflected or stored without sanitization.
2. Inject a JavaScript payload designed to exfiltrate session data or perform privileged actions.
3. Lure an authenticated Nagvis user to trigger the payload via phishing or a shared link.
4. Capture stolen credentials or session tokens and use them to access the monitoring environment.

How to detect it

Examine web server access logs and Nagvis application logs for requests containing script tags, onerror handlers, or encoded JavaScript in parameters that previously reached user-facing pages; look for unusual cookie or localStorage access patterns in browser telemetry from Nagvis users.

What your security team should do

• Prioritize upgrade of all Nagvis instances to the fixed commit within the next maintenance window.
• Scan existing Nagvis configurations and dashboards for any user-supplied content that may still contain unsanitized data.
• Enable web application firewall rules that block common XSS patterns targeting monitoring interfaces.
• Review access logs for unusual script execution or cookie exfiltration attempts after patching.