CVE-2024-57556

What it actually does

This is a cross-site scripting issue associated with nbubna store versions 2.14.2 and earlier, specifically involving the store.deep.js component. If attacker-controlled input is handled by the vulnerable JavaScript path without safe encoding or sanitization, arbitrary script can execute in a victim user's browser in the security context of the affected web application. Depending on the application, this can allow session theft, credential phishing, unauthorized actions as the victim, data exposure through the browser, or delivery of follow-on browser-based payloads. The supplied package data also indicates Red Hat Enterprise Linux 7 compat-exiv2-023 packages with fixes available in version 0:0.23-2.el7_9; organizations should validate both the JavaScript component exposure and the listed platform package versions because the provided affected-product metadata appears inconsistent with the XSS description.

Why it matters to the business

Successful exploitation can let an attacker abuse trusted web application sessions, impersonate users, steal sensitive information visible in the browser, or trick users into submitting credentials or approving unauthorized actions. The CVSS score is moderate and EPSS is currently low, and the issue is not listed in CISA KEV or known ransomware use, so broad active exploitation is not indicated from the supplied data. However, the vulnerability has been public for a long period, which increases the chance that proof-of-concept techniques or automated scanners may exist even if no mature exploit is reported.

How an attack unfolds

An attacker first identifies a web application that includes or exposes the vulnerable nbubna store.deep.js component from store version 2.14.2 or earlier. The attacker then finds an input path, URL parameter, fragment, stored value, or application state value that is processed by the vulnerable component and later rendered or interpreted by the browser. A crafted payload containing JavaScript or an event-handler-based script is delivered to a victim, commonly through a malicious link, embedded content, or a stored application object. When the victim opens the affected page, the vulnerable JavaScript handling causes the attacker's script to execute in the context of the legitimate site. The attacker can then attempt to read accessible page data, steal tokens not protected by browser controls, perform actions using the victim's session, or redirect the user to a phishing or malware-delivery site.

How to fix it

Upgrade affected nbubna store deployments to a version newer than 2.14.2 if an upstream fixed release is available, or replace/remove the vulnerable store.deep.js component where it is no longer required. For the supplied Red Hat Enterprise Linux 7 package metadata, update compat-exiv2-023 and compat-exiv2-023-debuginfo to 0:0.23-2.el7_9 or later across client, server, and workstation channels. As compensating controls, enforce contextual output encoding, sanitize untrusted input before it is consumed by client-side JavaScript, avoid rendering attacker-controlled values as HTML, and deploy a restrictive Content Security Policy that blocks inline script execution where feasible. Also ensure session cookies use HttpOnly, Secure, and SameSite attributes to reduce the impact of browser-based script execution.

How to confirm the fix worked

Confirm whether applications load store.deep.js and identify the exact nbubna store version in source repositories, dependency manifests, build artifacts, static asset directories, and deployed web roots. Validate that no deployed application uses store version 2.14.2 or earlier. For Red Hat Enterprise Linux 7 systems using the listed packages, verify that installed RPM versions are 0:0.23-2.el7_9 or later using package inventory or rpm/yum queries. Perform dynamic testing against previously vulnerable input paths with benign XSS probes and confirm the payload is encoded or blocked rather than executed. Review browser developer tools, automated DAST results, and Content Security Policy reports to confirm script execution is prevented.

Typical attack path

1. Identify an application using nbubna store version 2.14.2 or earlier or loading the vulnerable store.deep.js component.
2. Probe reflected, stored, or client-side input paths that are processed by the JavaScript component.
3. Craft a payload using script tags, JavaScript URLs, HTML event handlers, or encoded equivalents that survive application handling.
4. Deliver the payload through a malicious URL, stored application content, user-supplied field, or social-engineering message.
5. Wait for an authenticated or privileged user to load the affected page.
6. Execute attacker-controlled JavaScript in the victim's browser under the trusted application's origin.
7. Use the browser session to read accessible data, perform unauthorized actions, redirect the user, or stage follow-on attacks.

How to detect it

To determine whether exploitation has already occurred, review web server access logs, application logs, WAF events, reverse proxy logs, CDN logs, browser telemetry, CSP violation reports, SSO logs, and endpoint browser history where available. Focus on requests to pages that load or interact with store.deep.js and inspect URL query strings, fragments captured by client telemetry, form fields, referrers, and stored-content updates for script injection patterns. Look for encoded or plain HTML/script payloads, JavaScript event handlers, attempts to access cookies or local storage, and redirects to unfamiliar domains. Correlate suspicious payload delivery with subsequent user activity, including unusual authenticated actions, impossible travel or anomalous SSO events, session reuse from new IP addresses, unexplained profile or payment changes, and reports of unexpected pop-ups or redirects. Because XSS execution often occurs in the browser and may not leave a server-side exploit artifact, CSP report-only/enforced violation logs and client-side telemetry are particularly valuable.

• store.deep.js
• store v.2.14.2
• nbubna store
• <script
• %3Cscript
• </script>
• %3C%2Fscript%3E
• javascript:
• onerror=
• onload=
• onclick=
• alert(
• prompt(
• confirm(
• document.cookie
• localStorage
• sessionStorage
• eval(
• Function(
• String.fromCharCode
• atob(
• btoa(
• <img src=x onerror=
• <svg onload=
• compat-exiv2-023-0.23-2.el7_9
• compat-exiv2-023-debuginfo-0.23-2.el7_9

What your security team should do

• Inventory applications and assets for nbubna store, store.deep.js, and the listed compat-exiv2-023 packages; prioritize internet-facing and authenticated business-critical applications.
• Patch or upgrade affected components, including Red Hat Enterprise Linux 7 compat-exiv2-023 packages to 0:0.23-2.el7_9 or later where applicable.
• Because the vulnerability has been public for more than a year, search historical web, WAF, proxy, and application logs for XSS payload patterns targeting pages that load store.deep.js.
• Add or tighten Content Security Policy, disable inline script where feasible, and monitor CSP violation reports for attempted script injection.
• Review cookie security settings and ensure session tokens are protected with HttpOnly, Secure, and SameSite attributes.
• Conduct targeted DAST or manual validation on input paths that are rendered by client-side JavaScript, especially reflected URL parameters and stored user-controlled content.
• If suspicious exploitation is found, rotate affected user sessions, review account activity for unauthorized actions, and investigate phishing redirects or data access from victim sessions.