CVE-2024-11182

published 2024-11-15

CVE-2024-11182: An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This…

Priority P2 78 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

KEV ITW

An XSS issue was discovered in

MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message
with
JavaScript in an img tag. This could
allow a remote attacker

to load arbitrary JavaScript code in the context of a webmail user's browser window.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
mdaemon	email_server	<= 24.5.0	—
mdaemon	mdaemon	< 24.5.1	24.5.1

Detection & IOCs extracted from sources · hover to see the quote

other noembed tag with malformed title attribute containing JavaScript payload↗

other HTML img tag with embedded JavaScript↗

• → Detect inbound emails containing a noembed tag with a malformed title attribute, which is the specific injection vector used to smuggle JavaScript payloads through MDaemon's HTML parser. ↗
• → Detect inbound HTML emails containing JavaScript embedded within img tags, as this is the documented delivery mechanism for CVE-2024-11182. ↗
• → Monitor webmail sessions for outbound HTTP POST requests to hardcoded external addresses originating from within the webmail browser context, which is the exfiltration method used by the payload. ↗
• → Look for JavaScript in email bodies that creates invisible input fields, a technique used to trigger browser/password manager autofill for credential harvesting. ↗
• → Inspect email HTML bodies for scripts that read the DOM or issue HTTP requests to collect email content, contacts, webmail settings, login history, 2FA data, and passwords — all observed payload behaviors. ↗
• → Spear-phishing delivery context: emails referencing current news or political events with embedded news article excerpts should be treated as higher-risk for this campaign's initial access vector. ↗
• → Monitor MDaemon App Password creation events following email opens, as the payload was observed establishing persistent access via App Passwords after exploiting the XSS. ↗

• · The payload has no persistence mechanism and only executes when the malicious email is opened — detection must therefore focus on the email delivery and in-session network activity, not on host-based persistence artifacts. ↗
• · No victim interaction beyond opening the email is required, meaning click-based or redirect-based detection controls will not catch this exploit. ↗
• · Each deployed script has slightly different capabilities tuned per target product, so signature-based detection on a single payload variant may miss adapted versions. ↗
• · Patching to MDaemon Email Server version 24.5.1c or later is required to remediate the vulnerability; CISA remediation deadline is 2025-06-09. ↗

CVSS provenance

nvd v3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvd v4.0 5.3 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vulncheck 5.3 MEDIUM

cisa 5.3 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79