CVE-2024-48933

What it actually does

Allows remote attackers to inject arbitrary web script or HTML into the login page via a crafted username when userControl permits special HTML characters.

Why it matters to the business

Attackers can run malicious code in users' browsers during login, risking theft of credentials or sessions and unauthorized access to systems; the issue affects widely used packages with moderate exploit likelihood and no known active campaigns.

How an attack unfolds

An attacker supplies a username containing HTML or script tags to the login endpoint; if the non-default userControl setting renders the input without sanitization, the payload executes in the browser of anyone viewing the login page or related responses.

How to fix it

Upgrade github.com/hashicorp/vault (Go) to version 1.6.2 or later; apply vendor patches promptly given the published date and slight EPSS increase.

How to confirm the fix worked

Confirm the installed package version is 1.6.2 or newer; test login page with special-character usernames to verify input sanitization; review configuration to ensure userControl does not permit unsanitized HTML.

Typical attack path

1. Identify login endpoint and confirm non-default userControl configuration
2. Craft username containing script or HTML payload
3. Submit payload via login request
4. Induce target users or administrators to interact with the affected login flow
5. Execute arbitrary client-side code to steal data or perform actions

How to detect it

Inspect web server and application logs for login attempts containing HTML tags or script fragments in the username field; review audit trails for unexpected client-side redirects or data exfiltration after login page loads.

• <script
• onerror=
• onload=
• javascript:

What your security team should do

• Apply the 1.6.2 update immediately to eliminate the exposure
• Audit all instances for the non-default userControl setting and restrict it where possible
• Monitor EPSS trend and re-evaluate if scores rise further
• Add input validation and output encoding to login flows as defense-in-depth