--- title: iRedAdmin Multiple Vulnerabilities – CVE-2024-47227 description: CSA identified multiple vulnerabilities within iRedAdmin <= 2.5 which are tracked under CVE-2024-47227. iRedAdmin is an administrative panel to manage iRedMail Server (a single solution to install, configure and maintain a mail server). image: https://csacyber.com/hubfs/1727177358237.jpg --- [Skip to content](https://csacyber.com/blog/iredadmin-multiple-vulnerabilities-cve-2024-47227#main-content) [![CSA Cyber - Cyber Security Solutions to Protect your People](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=300&height=108&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber - Cyber Security Solutions to Protect your People")](https://csacyber.com/) - Services - [Offensive Security Services](https://csacyber.com/offensive-security-services) - [Penetration Testing](https://csacyber.com/penetration-testing) - [Red Teaming and attack simulations](https://csacyber.com/offensive-security-services#red-teaming) - [Continuous testing](https://csacyber.com/offensive-security-services#continuous-assurance) - [Managed offensive security](https://csacyber.com/offensive-security-services#managed-offensive) - [Consultancy Services](https://csacyber.com/cyber-consultancy-services) - [Frameworks & assessments](https://csacyber.com/cyber-consultancy-services/frameworks-and-assessments) - [Data protection](https://csacyber.com/cyber-consultancy-services#data-protection) - [Virtual leadership](https://csacyber.com/cyber-consultancy-services#virtual-leadership) - [Technical security consulting](https://csacyber.com/cyber-consultancy-services#technical-consultancy) - [Governance, Risk & Compliance (GRC)](https://csacyber.com/cyber-consultancy-services/governance-risk-and-compliance-services) - [Extended Managed Security Services](https://csacyber.com/extended-managed-security-services) - [Microsoft Sentinel SIEM](https://csacyber.com/extended-managed-security-services#microsoft-sentinel) - [SOC services](https://csacyber.com/extended-managed-security-services#soc-services) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/extended-managed-security-services#cyber-helpdesk) - [Incident Response Services](https://csacyber.com/incident-response-services) - [Emergency Incident Response](https://csacyber.com/urgent/emergency-incident-response) - [Incident Response Retainer](https://csacyber.com/incident-response-services) - [Cyber Incident Readiness & Response Planning](https://csacyber.com/incident-response-services) - [Tabletop Exercises & Live-Range Engagements](https://csacyber.com/incident-response-services) - [Specialist Security Services](https://csacyber.com/specialist-services) - [AI Security](https://csacyber.com/cyber-services-for-ai) - [Operational Technology (OT)](https://csacyber.com/specialist-services#operational-technology) - [Cyber security for Private Equity](https://csacyber.com/specialist-services#mergers-and-acquisitions) - [Cyber training and education](https://csacyber.com/specialist-services#training-and-education) - [Virtual leadership](https://csacyber.com/specialist-services#leadership) - [Cyber Technologies](https://csacyber.com/cyber-technologies) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/cyber-technologies#sentinelone) - [AppGuard Endpoint & Server Zero Trust Protection](https://csacyber.com/cyber-technologies#appguard) - [Qualys Vulnerability Management as a Service (VMaaS)](https://csacyber.com/cyber-technologies#qualys-vmaas) - [Lookout Mobile Device Protection](https://csacyber.com/cyber-technologies#lookout) - [ThreatER DNS Protection](https://csacyber.com/cyber-technologies#threater-dns) - [Cyber Security Awareness & Training platform](https://csacyber.com/cyber-technologies#boxphish) - [About](https://csacyber.com/about-us) - [Careers](https://csacyber.com/careers) - [Certifications](https://csacyber.com/certifications-and-awards) - [Blog](https://csacyber.com/blog) - [Support Centre](https://csacyber.com/support) - Resources - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Partners](https://csacyber.com/partners) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) - [Contact](https://csacyber.com/contact-us) - Search Search Search September 24, 2024 4 min read time # iRedAdmin Multiple Vulnerabilities – CVE-2024-47227 ![Simone Q](https://app.hubspot.com/settings/avatar/d41d8cd98f00b204e9800998ecf8427e) [Written by: Simone Q -](https://csacyber.com/blog/author/simone-q) [Vulnerability](https://csacyber.com/blog/tag/vulnerability) ![](https://csacyber.com/hubfs/1727177358237.jpg) ### TL;DR CSA identified multiple vulnerabilities within iRedAdmin \<= 2.5 which are tracked under CVE-2024-47227. iRedAdmin is an administrative panel to manage iRedMail Server (a single solution to install, configure and maintain a mail server). The vendor released a fix to the reported vulnerabilities and version 2.6 is currently not vulnerable. The product iRedAdmin-Pro was never affected by these vulnerabilities. ### Technical Details Multiple instances of reflected Cross-Site Scripting (XSS) were identified in the iRedAdmin panel, which affected version 2.5 and below. Reflected Cross-Site Scripting (XSS) is a web security vulnerability where an attacker injects malicious scripts into a URL. The script is executed when a user clicks on this manipulated link. The script does not persist on the server and only runs in the immediate response. This can allow the attacker to perform actions, view, or modify information within the application as the user clicking on the tampered link. The following pages and parameters were susceptible to reflected XSS: ![](https://media.licdn.com/dms/image/v2/D4E12AQGxfkoT6R6nIg/article-inline_image-shrink_1500_2232/article-inline_image-shrink_1500_2232/0/1727176878062?e=1738800000&v=beta&t=PQacIlbE5VQwzbWSKua3uexKPtPOVWDnq00EZda5E3o) A proof-of-concept XSS would look like the following: ![](https://media.licdn.com/dms/image/v2/D4E12AQEqFymAHWUv5Q/article-inline_image-shrink_1500_2232/article-inline_image-shrink_1500_2232/0/1727176913761?e=1738800000&v=beta&t=H1g1NQQlHc5_Gk3tqebIVZamns9dVhj5MjZfIava3zw) Figure 1 - Response including the injected JS code Additionally, a Host Header Injection was also observed affecting the redirect functionality of the application. The use of ‘self’ in the Python script, will give an implicit trust to the “Host” request header, making it build response based on its content. An example of this can be observed in the Redirect component of iRedAdmin: ![](https://media.licdn.com/dms/image/v2/D4E12AQG5us8luYGg8A/article-inline_image-shrink_1500_2232/article-inline_image-shrink_1500_2232/0/1727176949232?e=1738800000&v=beta&t=2DujLXq6Q_sSiL3E1q5WiFGtiG1PTSvo5MJ-syvVwCw) Figure 2 - Host Header Injection ### Demonstrating Impact – Admin Account Creation The impact of reflected XSS attacks can be severe depending on the configuration of the webserver and cookie flags. If an attacker can control a script that is executed in the victim’s browser, then they can typically fully compromise that user. Amongst other things, the attacker can perform any action within the application that the user can perform, view any information that the user is able to view, modify any information that the user is able to modify, and initiate interactions with other application users. The attack could be targeted directly against a known user, or could be an indiscriminate attack against any users of the application. The need for an external delivery mechanism for the attack means that the impact of reflected XSS is generally less severe than stored XSS, where a self-contained attack can be delivered within the vulnerable application itself. To demonstrate the impact of this XSS, SCCS will create a new administrative user in iRedAdmin. To do so, the following actions will be required: 1. Fetch the ‘/iredadmin/create/admin’ page to get a valid ‘csrf\_token’ 2. Issue a POST request to ‘/iredadmin/create/admin’ to create a new administrative user, attaching the value of a valid ‘csrf\_token’   The body of the POST request should contain the following elements: ![](https://media.licdn.com/dms/image/v2/D4E12AQGUlMyHpRy9Ww/article-inline_image-shrink_1500_2232/article-inline_image-shrink_1500_2232/0/1727177044349?e=1738800000&v=beta&t=nVQ0TMXEmMq83tU-F6MxFmvWcqOE68UpyX5O6eIIBW4) To automate both operations, we can use the following JavaScript code: ![](https://media.licdn.com/dms/image/v2/D4E12AQFBtEovL-GsAA/article-inline_image-shrink_1500_2232/article-inline_image-shrink_1500_2232/0/1727177129907?e=1738800000&v=beta&t=7C2Xz7fgSbopg0N708z0HlaRSc5qVc2pq3rx2yv7jKw) The above is however too long and containing unnecessary elements (comments, error handling and output controls). We can therefore create a minified version, which would look like the following: ![](https://media.licdn.com/dms/image/v2/D4E12AQEG_BBP4UbfPw/article-inline_image-shrink_1500_2232/article-inline_image-shrink_1500_2232/0/1727177175663?e=1738800000&v=beta&t=HEw5GehABuotRaEt42sT-2Fdcov2EEAfPo1IiNMFAQY) Next, we can URL-encode the full payload directly in the vulnerable parameter (don’t forget to include “”\>\\[payload\]\”): ![](https://media.licdn.com/dms/image/v2/D4E12AQHtsytMhQB8Yg/article-inline_image-shrink_1500_2232/article-inline_image-shrink_1500_2232/0/1727177212986?e=1738800000&v=beta&t=tlHnhHcQh4qiT0fsVZwee2Ko4o2Hyh7Chin7NCgEAY4) This is however looking too suspicious to be send to an iRedAdmin – In this case we can use a URL-shortener and create a smaller link: ![](https://media.licdn.com/dms/image/v2/D4E12AQGF5JNhwqyRlQ/article-inline_image-shrink_1500_2232/article-inline_image-shrink_1500_2232/0/1727177236172?e=1738800000&v=beta&t=-XRQK76sdn0pxlc2fLba7rrI42z6fLUiWr72M1GaTac) Figure 3 - Payload in URL-shortener The vulnerable URL can be then sent to an iRedAdmin user via email or via IM, for example as a Teams message: ![](https://media.licdn.com/dms/image/v2/D4E12AQGUog3dBDpMAg/article-inline_image-shrink_1500_2232/article-inline_image-shrink_1500_2232/0/1727177268614?e=1738800000&v=beta&t=x8JKjK3nJWczulZ4u1dd1gdHJVuuMTACJS9vglU4EGo) Figure 4 - Bait Teams Message Once an administrative user (already logged-in within iRedMail) clicks the link, a new POST request will be issued using his/her session cookie, to create a brand-new administrative user in the platform: ![](https://media.licdn.com/dms/image/v2/D4E12AQHy5MbF8aBC_w/article-inline_image-shrink_1500_2232/article-inline_image-shrink_1500_2232/0/1727177294833?e=1738800000&v=beta&t=z9hK-Bd8mv0VDH81unrWqAVJzo37bWJGXRFxbMWFGDA) Figure 5 - New Admin User ### Remediation As of 2.6, iRedAdmin sanitises untrusted user input to prevent HTML and JavaScript code injection. This fix successfully mitigated the aforementioned XSS and Host Header Injection vulnerabilities. ### Disclosure Timeline 05/07/2024: XSS instances identified and requested a technical contact to [info@iredmail.org](mailto:info@iredmail.org) 06/07/2024: CVE Requested to MITRE for multiple XSSs – Assigned just in September 06/07/2024: Technical details sent to Zhang Huangbin, founder of iRedMail 16/07/2024: Version 2.6 released fixing the reported vulnerabilities 24/09/2024: This blogpost published Related Posts ## You may also like this [Similar Articles](https://csacyber.com/blog) [![](https://csacyber.com/hs-fs/hubfs/Blog%20images%20%281%29.jpg?width=624&height=427&name=Blog%20images%20%281%29.jpg)](https://csacyber.com/blog/when-the-sea-becomes-the-battleground-what-the-texas-bound-tanker-attacks-tell-us-about-ot-security) October 19, 2026 5 min read ### [When the sea becomes the battleground: What the Texas-bound tanker attacks tell us about OT security](https://csacyber.com/blog/when-the-sea-becomes-the-battleground-what-the-texas-bound-tanker-attacks-tell-us-about-ot-security) The recent cyber incidents involving two Texas-bound energy tankers may be one of the clearest... [![Nathan Long](https://csacyber.com/hs-fs/hubfs/1722023909652.jpg?width=40&height=40&name=1722023909652.jpg) Nathan Long](https://csacyber.com/blog/author/nathan-long) [![](https://csacyber.com/hs-fs/hubfs/Blog%20images.jpg?width=624&height=427&name=Blog%20images.jpg)](https://csacyber.com/blog/the-attack-surface-has-changed.-the-fundamentals-have-not) October 16, 2026 14 min read ### [The attack surface has changed. The fundamentals have not.](https://csacyber.com/blog/the-attack-surface-has-changed.-the-fundamentals-have-not) Note from the author: Fair warning: this turned into a longer post than planned. I’m under no... [![Nathan Long](https://csacyber.com/hs-fs/hubfs/1722023909652.jpg?width=40&height=40&name=1722023909652.jpg) Nathan Long](https://csacyber.com/blog/author/nathan-long) [![](https://csacyber.com/hs-fs/hubfs/20230510-N1005919-Edit1.jpg?width=624&height=427&name=20230510-N1005919-Edit1.jpg)](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) August 24, 2026 2 min read ### [FluidOne Group appoints Charly Davis as Managing Director of CSA Cyber to advance its security-first strategy](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) Experienced industry leader joins FluidOne to strengthen integrated cyber, IT and secure networking... [![CSA Cyber](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Stacked.png?width=40&height=40&name=CSA%20Cyber%20Logo%20FNL_Stacked.png) CSA Cyber](https://csacyber.com/blog/author/csa-cyber) [![CSA Cyber Logo FNL\_Full Logo](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=3463&height=1248&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber Logo FNL_Full Logo")](https://csacyber.com/) Established in 2013, Cyber Security Associates Limited trading as CSA Cyber provides cyber consultancy and cyber managed services which help to detect, protect and educate against the ever-changing cyber threat. We have built our team from a foundation of Government (ex-Military) and Commercially experienced specialists all holding current and relevant cyber certifications. Today our core services are based around a 24/7 Security Operations Centre (SOC) based in Gloucester. #### News & Resources - [Blog](https://csacyber.com/blog) - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Careers](https://csacyber.com/careers) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) #### Quick Links - [About Us](https://csacyber.com/about-us) - [Certifications](https://csacyber.com/certifications-and-awards) - [Our Parent Company](https://www.fluidone.com) - [Partners](https://csacyber.com/partners) - [Contact Us](https://csacyber.com/contact-us) - [Anti Bribery Policy](https://csacyber.com/hubfs/CSAAnti-BriberyPolicy.pdf) - [Complaints Policy](https://csacyber.com/hubfs/CSAComplaintsPolicy.pdf) - [Corporate Social Responsibility Policy](https://csacyber.com/hubfs/CSACorporateSocialResponsibilityPolicy.pdf) - [Slavery and Human Trafficking Statement](https://csacyber.com/hubfs/CSASlaveryandHumanTraffickingStatement.pdf) - [NCSC CHECK Status Verification](https://www.ncsc.gov.uk/organisation/csa-cyber/check-penetration-testing) - [CREST Approved Certification Verification](https://www.crest-approved.org/member_companies/csa-cyber/) #### Contact Information **United Kingdom - London** Cyber Security Associates Ltd 5 Hatfields, London, SE1 9PG   **United Kingdom - Gloucester** Cyber Security Associates Ltd Unit 11, Wheatstone Court, Waterwells Business Park, GL2 2AQ   **Phone:** [+44(0) 300 303 4691](tel:03003034691) **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   **United States of America** Cyber Security Associates Inc. 6010 W. Spring Creek Pkwy, Plano, Texas, 75024   **Phone:** [+1 469 750 1695](tel:14697501695)  **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   [![trust-pilot](https://csacyber.com/hs-fs/hubfs/trust-pilot.png?width=178&height=104&name=trust-pilot.png)](https://uk.trustpilot.com/review/csa.limited)   --- - [Website Terms of Use](https://csacyber.com/website-terms-of-use) - [Website Privacy Policy](https://csacyber.com/privacy-notice) - [Website Cookie Policy](https://csacyber.com/cookie-policy) Copyright 2026. Cyber Security Associates Ltd [Follow us on Facebook](https://www.facebook.com/CSALIMITED/) [Follow us on LinkedIn](https://www.linkedin.com/company/csa-cyber/) [Follow us on Twitter](https://twitter.com/cybersecurityis) [Follow us on Facebook](https://www.youtube.com/@cybersecurityassociateslim) [Follow us on Facebook](https://www.instagram.com/cybersecurityassociates) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Simone Q", "url" : "https://csacyber.com/blog/author/simone-q" }, "dateModified" : "2024-12-07T14:26:19.909Z", "datePublished" : "2024-09-24T04:15:00.000Z", "headline" : "iRedAdmin Multiple Vulnerabilities – CVE-2024-47227", "image" : [ "https://csacyber.com/hubfs/1727177358237.jpg" ], "mainEntityOfPage" : { "@id" : "https://csacyber.com/blog/iredadmin-multiple-vulnerabilities-cve-2024-47227", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://csacyber.com/hubfs/csacyber-logo-black-01.svg" }, "name" : "Cyber Security Associates Ltd" } } ```