CVE-2024-52762

What it actually does

Cross-site scripting vulnerability allowing arbitrary JavaScript or HTML execution through unsanitized input to the tz parameter in /master/header.php.

Why it matters to the business

Attackers may hijack user sessions or perform unauthorized actions within the web monitoring interface, risking exposure of infrastructure metrics and credentials in environments running the affected monitoring software; low exploitation likelihood reduces immediate urgency despite weaponized exploit availability.

How an attack unfolds

An attacker crafts a malicious tz parameter containing script payloads and delivers a link or forces a victim to load the compromised header.php page, causing the browser to execute the injected code; public weaponized exploits facilitate this in Ganglia-web versions 3.73-3.76.

How to fix it

Upgrade Ganglia-web to a version beyond 3.76 that sanitizes the tz parameter; apply input validation or web application firewall rules blocking script patterns in query parameters as a temporary measure.

How to confirm the fix worked

Verify the deployed Ganglia-web version is newer than 3.76, then test the tz parameter with benign script markers to confirm output encoding prevents execution.

Typical attack path

1. Locate an internet-facing or internal Ganglia-web instance running version 3.73-3.76
2. Craft a URL injecting a script payload into the tz parameter of /master/header.php
3. Deliver the link via phishing, malicious page, or direct access to an authenticated user
4. Execute arbitrary scripts in the victim's browser context to steal cookies, session tokens, or perform actions

How to detect it

Inspect web server logs for requests to /master/header.php containing the tz parameter with HTML or script tags; monitor for unusual browser behavior or unexpected redirects from the monitoring interface.

• /master/header.php?tz=<script
• tz parameter containing javascript: or onerror=

What your security team should do

• Prioritize upgrade of Ganglia-web instances to a patched release
• Implement WAF rules to sanitize or block suspicious tz parameter values
• Review web access logs for signs of parameter manipulation
• Educate users on avoiding untrusted links to internal monitoring tools