CVE-2024-6307

What it actually does

Stored cross-site scripting via the HTML API due to insufficient input sanitization and output escaping on URLs, allowing authenticated users with contributor-level access to inject arbitrary web scripts.

Why it matters to the business

Attackers with limited access can insert malicious scripts that execute for other users, potentially leading to unauthorized data access, session hijacking, or defacement across affected installations.

How an attack unfolds

An authenticated attacker with contributor privileges crafts a page containing a malicious URL that bypasses sanitization in the HTML API; when other users access the injected page the script executes in their browser context.

How to fix it

Upgrade zoneminder on Debian 11 and 12 to version 1.34.21-1 or later; for GIT builds apply commit 9268db14a79c4ccd444c2bf8d24e62b13207b413 or newer.

How to confirm the fix worked

Confirm the installed version matches or exceeds the listed fixed versions and test that URL inputs are properly sanitized and escaped in rendered pages.

Typical attack path

1. Obtain contributor-level authenticated access
2. Craft and submit a page containing a malicious URL exploiting insufficient URL sanitization
3. Store the payload via the HTML API
4. Wait for other users to access the affected page triggering script execution

How to detect it

Review web server and application logs for unexpected script tags or encoded payloads in URLs and HTML content; inspect page source for injected scripts from contributor-created content.

What your security team should do

• Apply the specified upgrades immediately given the public disclosure
• Audit contributor accounts and limit privileges where possible
• Monitor for unusual script execution or unexpected content in pages