CVE-2023-24497 in VPN
Summary
by MITRE • 07/06/2023
Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploited through the remote_subnet field of the database
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/06/2025
The vulnerability identified as CVE-2023-24497 represents a critical cross-site scripting flaw within the Milesight VPN v2.0.2 software suite, specifically manifesting in the requestHandlers.js file within the detail_device functionality. This security weakness allows malicious actors to inject arbitrary JavaScript code into web applications through carefully crafted HTTP requests, creating a significant threat vector for unauthorized access and data manipulation. The vulnerability stems from inadequate input validation and output encoding mechanisms that fail to properly sanitize user-supplied data before processing it within the application's response handling logic. The attack surface is particularly concerning as it targets the remote_subnet field of the database, which serves as a critical parameter for network configuration and device management within the VPN infrastructure.
The technical exploitation of this vulnerability occurs through the manipulation of the remote_subnet field, which acts as an entry point for malicious payloads. When the application processes HTTP requests containing crafted JavaScript code within this parameter, the system fails to properly escape or encode the input before rendering it in the web interface. This allows attackers to execute malicious scripts within the context of other users' browsers, potentially leading to session hijacking, credential theft, or unauthorized administrative actions. The vulnerability falls under CWE-79 - Improper Neutralization of Input During Web Page Generation, which specifically addresses the failure to properly sanitize user input that gets reflected back to web clients. This weakness enables attackers to bypass standard security controls and establish persistent access to the affected system.
The operational impact of CVE-2023-24497 extends beyond simple script execution, as it can be leveraged to compromise the entire VPN infrastructure and associated network resources. An attacker who successfully exploits this vulnerability can potentially gain unauthorized access to network devices, manipulate configuration settings, and establish persistent backdoors within the Milesight VPN environment. The remote_subnet field manipulation creates a direct pathway for attackers to inject malicious code that could redirect users to phishing sites, steal sensitive authentication credentials, or even execute commands on the underlying system. This vulnerability aligns with ATT&CK technique T1566.001 - Phishing: Spearphishing Attachment, as attackers can craft malicious payloads that appear legitimate within the VPN management interface, making detection more challenging for security teams.
Security professionals should implement immediate mitigations including input validation and output encoding controls to prevent malicious JavaScript from being executed within the application's response handling. The recommended approach involves implementing strict sanitization of all user inputs, particularly those fields that are directly rendered in web pages such as the remote_subnet parameter. Organizations should also consider implementing Content Security Policy (CSP) headers to restrict script execution and prevent unauthorized code injection. Additionally, regular security assessments and penetration testing should be conducted to identify similar vulnerabilities within the Milesight VPN infrastructure. The vulnerability demonstrates the critical importance of proper input validation and output encoding practices, as outlined in OWASP Top Ten Project recommendations for preventing XSS attacks. Network segmentation and monitoring solutions should also be deployed to detect anomalous traffic patterns that may indicate exploitation attempts.