CVE-2012-4360

Why Exploitable

The CVE-2012-4360 vulnerability is exploitable due to a cross-site scripting (XSS) flaw in the mod_pagespeed module for the Apache HTTP Server. This allows remote attackers to inject arbitrary web script or HTML, potentially leading to unauthorized access or malicious activities.

Key factors affecting exploitability:

• EPSS (Empirical Exploitation Probability Score) is not available, making it difficult to assess the likelihood of exploitation.
• The absence of public exploit/PoC references and CISA KEV listing reduces the perceived urgency. However, organizations should still validate their systems' vulnerability to this CVE, especially if they are using the affected mod_pagespeed module versions (0.10.19.1 through 0.10.22.4). Validation is crucial to ensure the security of their Apache HTTP Server installations and prevent potential XSS attacks.

Overview

CVE-2012-4360 (CWE-79) in Google mod_pagespeed for Apache HTTP Server. Reflected script injection through URI reflected in module-generated admin/debug output.

Technical details

Insufficient encoding of URI components in pagespeed handler responses.

Impact

Session abuse against admins; low direct server compromise.

Exploitation steps

1. Detect mod_pagespeed. 2. Craft XSS URI. 3. Trick victim to open link. 4. Execute script in site origin.

Indicators of compromise

XSS probes in access logs targeting pagespeed endpoints.

Mitigation and workarounds

Upgrade mod_pagespeed beyond 0.10.22.4; disable module; restrict admin paths.

Community reactions

2012 mod_pagespeed security update; emphasized not exposing optimizer UI publicly.

Additional resources

• NVD CVE-2012-4360