CVE-2024-52053: 
Wowza Streaming Engine vulnerability analysis and mitigation

CVE-2024-52053 is a Stored Cross-Site Scripting vulnerability discovered in the Manager component of Wowza Streaming Engine versions below 4.9.1. The vulnerability was disclosed on November 21, 2024, and affects all Wowza Streaming Engine Manager versions. This security flaw allows an unauthenticated attacker to inject client-side JavaScript into the web dashboard to automatically hijack admin accounts (Rapid7 Blog).

The vulnerability exists in the Manager component's log handling functionality. When a user fails to login to Wowza Streaming Engine Manager, the log file at manager/logs/wmsmanager_access.log is updated with the failed login attempt. The administrator dashboard contains a 'Logs' tab that displays this log data, but fails to properly sanitize the attacker-provided input before displaying it using innerHTML. This allows injection of malicious JavaScript that executes when an administrator views the logs. The vulnerability has received a CVSS v3.1 base score of 9.6 CRITICAL and a CVSS v4.0 score of 8.7 HIGH (NVD).

The vulnerability allows an unauthenticated attacker to execute arbitrary JavaScript code in the context of an administrator's browser session when they view the logs dashboard. This can lead to complete compromise of the administrator's account and subsequent access to all administrative functions. The vulnerability can be chained with other vulnerabilities like CVE-2024-52052 to achieve remote code execution with high privileges (root on Linux, LocalSystem on Windows) (Rapid7 Blog).

The vulnerability has been patched in Wowza Streaming Engine version 4.9.1, released on November 20, 2024. Organizations are advised to upgrade to this version or later to remediate the vulnerability. Rapid7 InsightVM and Nexpose customers can assess their exposure to CVE-2024-52053 with authenticated vulnerability checks available as of the November 20, 2024 content release (Wowza Release Notes).

Wowza Media Systems responded proactively to the disclosure, stating 'We at Wowza Media Systems are focused on security excellence, and by partnering with trusted researchers like Rapid7, we proactively respond to and fix vulnerabilities to safeguard our customers' interests' (Rapid7 Blog).