CVE-2024-30476: PowerStore Manager Stored XSS Vulnerability – Dell Security

Technical summary

CVE-2024-30476 is a stored cross-site scripting (XSS) vulnerability in Dell PowerStore Manager's web interface. The vulnerability exists due to insufficient input validation and output encoding, allowing an authenticated, low-privileged user to persistently inject JavaScript payloads into the application database. When an administrator or other user accesses the compromised content, the malicious script executes in their browser within the security context of PowerStore Manager, potentially enabling session hijacking, credential theft, or administrative action abuse. The CVSS 3.1 score of 5.4 (Medium) reflects the requirement for prior authentication, user interaction, and limited impact scope.

Business impact

A successful exploitation chain could compromise the integrity of storage management operations. An insider threat or compromised low-level service account could inject payloads targeting administrators, leading to unauthorized configuration changes, data exposure, or disruption of storage services. In multi-tenant or high-security environments, this vulnerability increases insider risk and complicates compliance audits by enabling unauthorized privilege escalation through session hijacking.

Affected systems

Dell PowerStore Manager is affected. The vulnerability applies to the web-based management interface and impacts all authenticated sessions that interact with poisoned content. Storage administrators and operators using the Manager interface are at highest risk if they access pages containing injected scripts.

Exploitability

Exploitation requires valid credentials and low-level authenticated access to PowerStore Manager. The attacker must inject the payload into a location frequented by higher-privileged users, and those users must interact with the malicious content while logged in. This is not remotely exploitable without authentication, and the attack surface is limited to authenticated users. No public exploit code or active exploitation has been reported as of the publication date.

Remediation

Apply vendor security patches when released. Until patching is possible, restrict PowerStore Manager access to trusted networks, limit low-privileged account creation and scope, and enforce multi-factor authentication for administrative accounts to reduce session hijacking risk. Monitor user account activity and review Manager audit logs for signs of unauthorized access or configuration changes.

Patch guidance

Contact Dell directly or consult Dell's security advisories for specific patch versions addressing CVE-2024-30476 in your PowerStore deployment. Patches are typically released through Dell's update portal. Test patches in a non-production environment before deployment to ensure compatibility with your storage infrastructure.

Detection guidance

Monitor PowerStore Manager logs for unusual administrative activity, especially configuration changes initiated by unexpected accounts. Search web server logs for JavaScript payloads or suspicious HTML in request parameters targeting the Manager UI. Use web application firewalls to detect and block known XSS patterns in POST/PUT requests to the Manager interface. Network intrusion detection systems may flag suspicious scripts if traffic inspection is enabled.

Why prioritize this

Although the CVSS score is moderate, prioritize this vulnerability if you operate PowerStore in security-sensitive environments or have strict data governance requirements. The stored nature of the XSS means the attack persists and can affect multiple users over time. Low-privileged account compromise is common in ransomware campaigns, making this a potential stepping stone to administrative access.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects moderate risk: network-accessible authentication is required (PR:L), user interaction is necessary (UI:R), the attack has changed scope (S:C), and impact is limited to confidentiality and integrity without availability loss (C:L/I:L/A:N). In isolated or air-gapped environments, the network accessibility factor is mitigated. In high-availability storage clusters or cloud-connected deployments, the scope change and integrity impact carry greater operational significance.

Frequently asked questions