PT-2024-2648 · Egindemirbilek · Northstar C2

Published 2024-03-11 · Updated 2024-08-15 · CVE-2024-28741

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions EginDemirbilek NorthStar C2 version 1

Description The issue allows a remote attacker to execute arbitrary code via the login.php component due to a Cross Site Scripting vulnerability. This vulnerability exists because of the lack of protection measures for the web page structure, potentially enabling an attacker to execute commands on NorthStar C2 agents.

Recommendations For EginDemirbilek NorthStar C2 version 1, as a temporary workaround, consider disabling the login.php component until a patch is available. Restrict access to the vulnerable component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-02715

CVE-2024-28741

Affected Products

Northstar C2

References · 26

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/northstar_c2_xss_to_agent_rce.rb · Exploit
• 🔥 https://github.com/chebuya/CVE-2024-28741-northstar-agent-rce-poc · Exploit
• 🔥❌ https://github.com/topics/post-exploitation · Exploit, Deleted
• https://bdu.fstec.ru/vul/2024-02715 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-28741 · Security Note
• https://github.com/terjanq/Tiny-XSS-Payloads · Note
• https://github.com/EnginDemirbilek/NorthStarC2 · Note
• https://github.com/ACE-Responder/RogueSliver · Note
• https://twitter.com/arpsyndicate/status/1793333387232792804 · Twitter Post
• https://twitter.com/cvefeedio/status/1767467427212796016 · Twitter Post
• ❌ https://github.com/topics/rat · Note, Deleted
• ❌ https://github.com/topics/backdoor · Note, Deleted
• ❌ https://github.com/topics/c2 · Note, Deleted
• https://blog.chebuya.com/posts/discovering-cve-2024-28741-remote-code-execution-on-northstar-c2-agents-via-pre-auth-stored-xss · Note
• https://twitter.com/_chebuya/status/1767376416390385803 · Twitter Post