CVE-2023-32693

Executive Summary

CVE-2023-32693 is a Cross-Site Scripting (XSS) vulnerability in the Decidim participatory democracy framework, a Ruby on Rails application originally developed for the Barcelona City government. The flaw resides in the external link redirection feature, allowing a remote attacker to execute arbitrary JavaScript code in the context of a currently logged-in user. Given Decidim's purpose as a citizen participation platform — where users endorse and support proposals — an attacker exploiting this flaw can force victims to unknowingly endorse or support proposals they do not actually intend to support, undermining the integrity of democratic participation processes. The vulnerability has been patched in Decidim versions 0.27.3 and 0.26.7.

Technical Analysis

The vulnerability is categorized as a Cross-Site Scripting (XSS) issue specifically located in the external link redirection functionality of the Decidim framework. Decidim is a participatory democracy platform, written in Ruby on Rails, that enables citizens to propose, debate, and vote on municipal decisions. A critical component of this platform is the ability to share and reference external resources — news articles, documents, or websites — that provide supporting context for proposals. This external linking feature is the attack surface.

Attack Mechanism: The NVD description states that "the external link feature is susceptible to cross-site scripting." At the vulnerability-class level, this is a reflected or stored XSS in the URL handling logic. When a user interacts with an external link — likely by clicking a "redirect" intermediary that validates the destination URL — the application fails to properly sanitize or validate the href parameter or the redirect target. A maliciously crafted URL can inject JavaScript payloads via vectors such as:

• javascript: URIs — where the link's href attribute begins with javascript:alert(document.cookie) instead of http:// or https://, causing the browser to execute the code in the page context.
• Event handler injection — payloads embedded in HTML attributes, e.g., " onmouseover="alert(1).
• Obfuscated encoding — using URL encoding, HTML entities, or Unicode escapes to bypass weak server-side allow-list filters (e.g., filtering only http but not java%73cript:).

Because Decidim's external link feature may present an intermediate "you are leaving Decidim" page before redirecting the user, the attacker-controlled URL could be stored or rendered without proper output encoding, allowing the payload to execute when the page loads.

Attack Surface: The attack surface includes any Decidim deployment where users can include external links in their contributions — proposals, comments, or participatory budget ideas. The vulnerability is theoretically exploitable by unauthenticated remote attackers (as reflected by the CVSS vector scoring Network, Low complexity, No privileges required), though user interaction (a logged-in user clicking a crafted link) is required for the XSS to fire. The application is likely a Ruby on Rails monolith with an ERB template rendering layer; the lack of proper sanitization in the external link helper method is the root cause.

Exploitation Scenarios

Attack Chain for CVE-2023-32693:

1. Reconnaissance / Target Identification: The attacker identifies a Decidim instance — typically exposed on the internet at municipal government domains (e.g., participa.barcelona.cat). Publicly accessible proposals and forums allow the attacker to identify active participation campaigns and targets of interest (e.g., high-profile proposals with many endorsements).

2. Flaw Triggering: The attacker crafts a malicious external link. Since the vulnerability resides in the external link redirection feature, the attacker can use two possible delivery methods:

   • If stored XSS: The attacker submits a new proposal, comment, or amendment containing a crafted external link. The payload is stored in the database and rendered for all subsequent viewers.
   • If reflected XSS: The attacker crafts a phishing URL that points to the Decidim site's external redirect endpoint with the JavaScript payload embedded in the URL parameter. The victim must click this link.

   In either case, the crafted input is designed to break out of the href attribute context and inject scripting elements (e.g., <script> tags or on* event handlers).

3. Payload / Execution: The XSS payload executes silently in the victim's browser session while the victim is authenticated on the Decidim instance. At the vulnerability-class level, this means the JavaScript runs in the same-origin context of the application, granting full access to the DOM, session cookies (if HttpOnly is not set), and — critically — the application's internal JavaScript API endpoints that handle endorsements and support for proposals.

4. Post-Exploitation — Integrity Manipulation: The NVD description explicitly states the intended abuse: "An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing." The injected JavaScript can programmatically submit POST requests to the application's endorsement endpoints via AJAX (fetch or XMLHttpRequest), impersonating the authenticated victim. For example, if a victim is a city council member or active participant, the attacker could fraudulently endorse a controversial proposal, creating a false impression of democratic consensus.

5. Broader Impersonation: Beyond endorsements, the XSS can also be used to exfiltrate the user's CSRF token and session cookies to an attacker-controlled server, enabling full account takeover for session hijacking or — depending on the user's role — privilege escalation to administrative functions.

Confidence Note: No public PoC or exploit code is currently tracked for this CVE. The attack chain described above is inferred from the vulnerability class (XSS in external link handling) and the explicit impact statement in the NVD description. Specific implementation details (function names, exact endpoints) are not available in public intelligence at this time.

Impact Assessment

Business Impact: The principal risk is the integrity of democratic participation data. Decidim is deployed by municipal governments for official consultation, participatory budgeting, and citizen proposal processes. An attacker committing mass fraudulent endorsements can:

• Skew policy outcomes — proposals with fabricated support may be prioritized by city officials.
• Damage public trust — if exposed, citizens may lose confidence in the legitimacy of the participation platform.
• Cause political embarrassment — high-profile manipulation of civic engagement tools can damage municipal government reputations.

CVSS Scoring (8.1 High): The base score of 8.1 reflects Network attack vector, Low complexity, No privileges required, and User interaction required. The Impact subscore indicates high impact on both Confidentiality and Integrity (likely C:H/I:H with restricted availability impact). The high confidentiality subscore suggests that session cookies and user data are accessible to the attacker beyond just integrity manipulation.

Affected Systems: All Decidim installations running versions prior to 0.26.7 and 0.27.3. Given that Decidim is an open-source framework self-hosted by organizations, the blast radius includes:

• Municipal governments (Spain, France, Latin America)
• Non-profit/CSO citizen engagement platforms
• Cooperatives and academic institutions using Decidim

Exploitation Likelihood: EPSS score of 0.00816 (53.7% percentile) indicates a moderately low probability of exploitation in the wild. The CVE is not listed in CISA KEV, suggesting no confirmed exploitation in the wild as of this report. However, the ease of XSS exploitation combined with the political significance of the platform's user base makes this a moderate-to-high risk for municipal deployments specifically.

Detection Guidance

Sigma Rule

title: Decidim External Link XSS - Suspicious URI Scheme in Link Parameters
status: experimental
description: Detects attempts to exploit CVE-2023-32693 by injecting javascript: or other dangerous URI schemes into Decidim external link redirection parameters
logsource:
  category: webserver
  product: apache # or nginx
detection:
  selection:
    cs-method: GET
    cs-uri-query|contains:
      - 'javascript:'
      - 'vbscript:'
      - 'data:text/html'
      - '%6a%61%76%61%73%63%72%69%70%74'
      - '<script>'
      - '<script>'
      - '" onerror='
      - '" onmouseover='
  condition: selection
falsepositives:
  - Legitimate users pasting non-http URLs in research contexts
  - Web vulnerability scanners performing baseline scans
level: high
tags:
  - attack.t1189
  - cve.2023.32693
  - cwe.79

YARA Rule

rule Decidim_XSS_External_Link_Payload {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detect XSS payload patterns targeting Decidim external link redirection (CVE-2023-32693)"
        cve = "CVE-2023-32693"
        cwe = "CWE-79"
        date = "2024-01-01"
    strings:
        $js_protocol = "javascript:" ascii wide nocase
        $vb_protocol = "vbscript:" ascii wide nocase
        $data_protocol = "data:text/html" ascii wide nocase
        $steal_cookie = "document.cookie" ascii wide nocase
        $ajax_post = "XMLHttpRequest" ascii wide nocase
        $endorse_keyword = "endorse" ascii wide nocase
        $fetch_post = "fetch('" ascii wide
        $event_handler = "onmouseover" ascii wide nocase
        $script_break = "</script>[" ascii wide nocase
        $encoded_js = "%6a%61%76%61%73%63%72%69%70%74" ascii wide nocase
    condition:
        uint16(0) == 0x0D0A and 2 of them
        // Rule targets log files, HTTP capture logs, or stored payload repositories
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Decidim CVE-2023-32693 External Link XSS Payload Attempt"; flow:to_server,established; content:"GET"; http_method; content:"decidim"; http_uri; content:"link"; http_uri; content:"redirect"; http_uri; content:"javascript:"; http_uri; nocase; content:"<script>"; http_uri; pcre:"/(javascript:|vbscript:|data:text\/html|%6a%61%76%61%73%63%72%69%70%74)/i"; classtype:web-application-attack; reference:cve,2023-32693; sid:1000001; rev:1;)

Elastic Detection

// EQL query for Elastic Security - detect encoded XSS payloads in Decidim URI paths
sequence by source.ip
  [network where event.action == "connection_attempted" and destination.port == 443]
  [http where event.category == "network" and
     http.request.method == "GET" and
     (http.request.uri contains "javascript:" or
      http.request.uri contains "%6a%61%76%61%73%63%72%69%70%74" or
      http.request.uri contains "<script>" or
      http.request.uri contains "onerror=" or
      http.request.uri contains "onmouseover=") and
     (http.request.uri contains "decidim" or
      http.request.uri contains "link" or
      http.request.uri contains "redirect")]

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri_path, "(?i)decidim.*(link|redirect)") 
    OR match(uri_query, "(?i)(javascript:|vbscript:|data:text/html|<script|onerror=|onmouseover=|%6a%61%76%61%73%63%72%69%70%74)")
| table _time, clientip, uri_path, uri_query, status, useragent, referer
| sort - _time
| stats count by clientip, uri_query
| where count > 3

Wazuh OSSEC Rule

<rule id="100326" level="12">
  <decoded>apache-accesslog</decoded>
  <match>decidim</match>
  <regex>GET \S+ (link|redirect)\S*</regex>
  <regex>(javascript:|vbscript:|data:text/html|%6a%61%76%61%73%63%72%69%70%74|%3Cscript%3E)</regex>
  <description>CVE-2023-32693 - Decidim external link XSS payload detected in URI</description>
  <group>web_application_attack,xss,cve_2023_32693,</group>
  <mitre>
    <id>T1189</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (no patch evidence from tracked sources) — Note: While the NVD description confirms the issue was patched in Decidim versions 0.27.3 and 0.26.7, our tracked patch sources have not yet recorded the official security advisory or patch diff. Immediate verification is advised.

1. Immediate Mitigations (before upgrading)

• Disable or restrict external link functionality: If possible, temporarily disable the external link redirection feature in the Decidim admin panel for non-admin roles to reduce attack surface.
• Deploy a WAF rule: Use the Suricata rule above or equivalent WAF rules (ModSecurity CRS with XSS rules enabled) to block requests containing javascript:, data:text/html, and encoded variants in URI parameters.
• Set HttpOnly and Secure flags on session cookies: This limits cookie theft via XSS, though the endorsement manipulation vector remains viable.
• Enable CSP (Content-Security-Policy): Configure a strict CSP header that disallows unsafe-inline scripts. This can neutralize many XSS execution vectors even if the payload slips through validation.

2. Patch / Upgrade Steps

• Upgrade Decidim to version 0.27.3 or 0.26.7 immediately. These are the confirmed patched releases. Deployments on lower versions are vulnerable.
• After upgrading, verify the external link feature properly sanitizes and validates URLs:
  • Only http:// and https:// protocols should be allowed.
  • Ensure output is HTML-encoded when rendered in templates.
  • Apply an allow-list-based URL validation (rejecting javascript:, data:, vbscript:).
• Run a regression test on the external link workflow to ensure legitimate links still function.

3. Long-Term Hardening

• Audit your Rails template rendering: Ensure all user-controlled input is passed through Rails' ERB::Util.html_escape or a safe-renderer like sanitize.
• Add automated XSS scanning: Integrate tools like OWASP ZAP or Burp Suite into your CI/CD pipeline to catch XSS regressions in new releases.
• Monitor Decidim's GitHub releases for future security advisories; subscribe to the decidim-security mailing list.
• Security awareness: Educate platform moderators to treat any suspicious external links in proposals/comments as potential phishing vectors.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-32693 — Official CVE record with NVD description and base score.
2. Decidim GitHub (Security Advisories): https://github.com/decidim/decidim/security — Monitor for the official security advisory for versions 0.26.7/0.27.3 patches (expected to be listed here).
3. Decidim Release Notes — v0.27.3: https://github.com/decidim/decidim/releases — Patch release confirmation and changelog.
4. Decidim Official Website: https://decidim.org — Framework documentation for administrators upgrading their installations.
5. MITRE ATT&CK — T1189 (Drive-by Compromise): https://attack.mitre.org/techniques/T1189/ — Technique reference for exploitation via user-initiated link interaction.

Report prepared by Valtersit Threat Intelligence. Exploitation in the wild: not confirmed as of this report date. CISA KEV listing: NO. Monitor vendor advisory channels for updated patch confirmation.