Loading vulnerability…
CVE-2024-54160 is a cross-site scripting vulnerability in dashboards-reporting, also known as Dashboards Reports, before version 2.19.0.0, as shipped with OpenSearch before 2.19. The flaw exists because Markdown content is not sanitized when previewing a header or footer. An attacker able to supply crafted Markdown to the preview functionality can cause untrusted script content to be rendered in a victim's browser within the application context.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository demonstrates a proof-of-concept (PoC) exploit for CVE-2024-54160, a stored HTML injection and XSS vulnerability in the Opensearch 'reports' plugin (versions 2.18.0 and 2.17.9). The exploit consists of two files: a README.md describing the vulnerability, exploitation steps, and remediation, and a keylogger.html file containing a simple HTML/JavaScript keylogger. The attack involves injecting an iframe referencing the attacker's keylogger.html into the report header or footer fields. When a victim previews the report, the keylogger is loaded and captures keystrokes, sending them to the attacker's server via HTTP requests. The exploit is a proof-of-concept and requires the attacker to host the keylogger.html file and have access to the vulnerable Opensearch instance. No framework is used; the exploit is standalone and demonstrates the impact of the vulnerability.
1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.