CVE-2024-52763

What it actually does

Allows execution of arbitrary web scripts or HTML through injection into the g parameter of graph_all_periods.php.

Why it matters to the business

Potential compromise of user sessions and data theft in monitoring web interfaces with low urgency due to limited exploit prevalence.

How an attack unfolds

An attacker injects a crafted payload into the g parameter and lures users to access the malicious link, executing scripts in their browser.

How to fix it

Update Ganglia-web beyond version 3.75 and sanitize or escape input for the g parameter.

How to confirm the fix worked

Test the g parameter with common XSS test strings to verify input sanitization and review application changelog for the applied fix.

Typical attack path

1. Identify vulnerable Ganglia-web instance between versions 3.73 and 3.75
2. Craft URL with malicious payload in the g parameter
3. Deliver link via phishing or other social engineering
4. Victim browser executes injected script

How to detect it

Inspect web server access logs for requests to graph_all_periods.php containing script tags, event handlers, or javascript in the g parameter.

• graph_all_periods.php?g=<script
• graph_all_periods.php?g=
• onerror=
• javascript:alert

What your security team should do

• Apply the latest Ganglia-web update to close the injection vector
• Add web application firewall rules to block script patterns in query parameters
• Review access logs for historical suspicious g parameter values