CVE-2024-52947

What it actually does

Allows injection of arbitrary web script or HTML through the url parameter on the upgradeSession/forceUpgrade confirmation page when the Upgrade session plugin is enabled.

Why it matters to the business

Attackers could hijack user sessions, steal credentials, or perform actions on behalf of authenticated users, potentially leading to unauthorized access across protected applications and increased support costs.

How an attack unfolds

An attacker crafts a malicious link containing a script payload in the url parameter of the upgrade session page, then tricks an authenticated user into visiting it; if the plugin is active, the script executes in the victim's browser context.

How to fix it

Upgrade LemonLDAP::NG to the commit fe2718cc2dd849966f690fb995d96f9ea391fa3f or later; disable the Upgrade session plugin if immediate upgrade is not feasible.

How to confirm the fix worked

Verify the deployed version includes commit fe2718cc2dd849966f690fb995d96f9ea391fa3f; test the upgradeSession endpoint with a benign payload to confirm the parameter is properly sanitized.

Typical attack path

1. Identify a target deployment with the Upgrade session plugin enabled
2. Craft a URL containing a malicious payload in the url parameter targeting the upgradeSession or forceUpgrade endpoint
3. Deliver the link via phishing or another social engineering channel
4. Victim authenticates and triggers the page, executing the injected script

How to detect it

Inspect web server and application logs for requests to upgradeSession or forceUpgrade endpoints containing suspicious url parameters with script tags, javascript: schemes, or encoded payloads; correlate with user sessions that exhibit unexpected behavior after visiting the page.

What your security team should do

• Apply the fix commit fe2718cc2dd849966f690fb995d96f9ea391fa3f immediately
• Audit configurations to identify any instances where the Upgrade session plugin is enabled
• Review web application firewall rules to block common XSS patterns on session-related endpoints
• Monitor for unusual script execution or unexpected redirects in application logs