CVE-2026-102374 in GestSup
Summary
by MITRE • 09/29/2026
GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML escaping. Unauthenticated attackers can send crafted emails to monitored mailboxes with nested MIME encoded-words to inject JavaScript that executes in technician sessions when viewing tickets.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The security flaw identified in GestSup versions prior to 3.2.62 represents a critical stored cross-site scripting vulnerability located within the IMAP OAuth connector component of the application. This issue stems from an improper handling and decoding sequence applied to email subjects retrieved via Internet Message Access Protocol connections that utilize OAuth for authentication. Specifically, when the system processes incoming emails, it applies HTML escaping to sanitize user-controllable input before rendering it in the web interface. However, a subsequent step involves double-decoding MIME-encoded content within these email headers without re-applying appropriate sanitization after the second decoding phase. This architectural oversight creates a window where maliciously crafted payloads can bypass initial security controls designed to neutralize script injection attempts.
The technical mechanism of this vulnerability relies on the specific behavior of MIME encoded-words, which are commonly used in email subjects to represent non-ASCII characters using ASCII-safe encoding schemes such as quoted-printable or base64. An unauthenticated attacker can exploit this by sending specially crafted emails containing nested MIME-encoded strings that include JavaScript code within the subject line. When these emails arrive at a monitored mailbox managed by GestSup, the application first decodes the outer layer of MIME encoding and then applies HTML escaping to prevent immediate execution. However, because the system subsequently performs a second decoding operation on the already escaped content, it effectively reverses the sanitization step for specific character sequences that were encoded in the initial payload. This double-decoding process restores the original malicious JavaScript code from its encoded form, allowing it to persist as executable script within the stored data structure of the ticketing system.
The operational impact of this vulnerability is significant due to its persistent nature and the high-privilege context in which it executes. Since the injected scripts are stored alongside legitimate ticket data, they do not require complex social engineering or immediate user interaction beyond viewing a specific record. When an authorized technician opens a compromised ticket within their session, the browser interprets the restored JavaScript code as part of the page content. This leads to the execution of arbitrary client-side scripts in the context of the authenticated user's session. Consequently, attackers can perform actions such as stealing sensitive session cookies or authentication tokens, hijacking active sessions, performing unauthorized actions on behalf of the technician, or defacing the application interface. The ability for unauthenticated actors to trigger this condition means that any incoming email with a crafted subject line serves as a potential attack vector against the entire organization using the platform.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. More specifically, it falls under the sub-category of Stored XSS where malicious scripts are permanently stored within target servers such as databases or message queues. In terms of adversary tactics and techniques, this exploit maps to MITRE ATT&CK technique T1059.007, which covers JavaScript execution on client-side targets. The attack chain involves initial access through email delivery followed by persistence via storage in the application database, ultimately leading to credential theft or session hijacking depending on the specific payload delivered after script execution.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary and most effective solution is to upgrade GestSup to version 3.2.62 or later, where this double-decoding flaw has been corrected by ensuring that output encoding is applied consistently after all decoding operations are complete. For organizations unable to patch immediately due to operational constraints, implementing a web application firewall rule set capable of detecting and blocking nested MIME-encoded payloads containing script tags may provide temporary relief, though such rulesets often require careful tuning to avoid false positives on legitimate email content. Additionally, developers should review the input validation pipeline to ensure that any data undergoing multiple transformations is subjected to final output encoding before being rendered in HTML contexts. Enforcing strict Content Security Policy headers can also mitigate the impact by restricting where scripts are allowed to execute and preventing access to sensitive cookies via JavaScript APIs.