CVE-2024-52875

An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is not properly sanitized before being used to generate a Location HTTP header in a 302 HTTP response. This can be exploited to perform Open Redirect or HTTP Response Splitting attacks, which in turn lead to Reflected Cross-Site Scripting (XSS). Remote command execution can be achieved by leveraging the upgrade feature in the admin interface.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

29.56% chance of exploitation in the next 30 days, 98th percentile

Nuclei

high · CWE-74

Published

2025-01-31

Updated

2025-02-12

Proof-of-concept exploits (1)

• https://karmainsecurity.com/hacking-kerio-control-via-cve-2024-52875

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-52875.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2024-5287
• CVE-2024-52883
• CVE-2024-5286
• CVE-2024-5290
• CVE-2024-5285
• CVE-2024-52949