CVE-2023-34089

Executive Summary

CVE-2023-34089 is a stored/cross-site scripting (XSS) vulnerability in the Decidim participatory democracy framework, specifically in the processes filter feature. An unauthenticated remote attacker can inject arbitrary JavaScript that executes in the context of a logged-in user's browser session, potentially causing victims to inadvertently endorse or support proposals against their intentions. The vulnerability affects Decidim versions prior to 0.27.3 and 0.26.7, and given the high CVSS score of 8.1, organizations operating vulnerable installations should prioritize remediation.

Technical Analysis

Decidim is a Ruby on Rails-based framework originally developed for the Barcelona City government's participation website. It provides features including proposals, debates, and participatory processes. The vulnerable component is the "processes filter" feature, which allows users to filter and search active participatory processes.

The vulnerability is a Cross-site Scripting (XSS) flaw in the processes filter component. The NVD description indicates that the processes filter feature is susceptible to XSS, which suggests that user-supplied input is not being properly sanitized or encoded before being reflected or rendered in the filter interface.

Vulnerability Mechanism: The attack mechanism is characteristic of the XSS vulnerability class — unvalidated or inadequately encoded user input is rendered in a web page context without proper output encoding. When a victim accesses a maliciously crafted URL or interacts with a page containing the injected payload, the browser interprets the attacker-controlled content as executable JavaScript in the context of the target application's origin.

Attack Surface: The processes filter is a publicly accessible feature in Decidim deployments, reachable by any unauthenticated user of the platform. The attack vector is network-based (AV:N in the CVSS vector), requiring no privileged access (PR:N). However, user interaction is required (UI:R) — the victim must click on a crafted link or visit a malicious URL.

Technical Details Limitation: The NVD description does not specify the exact parameter names, endpoint paths, or the precise input reflection mechanism. Based on the vulnerability class and the described impact, the flaw likely involves either reflected XSS through a filter query parameter or stored XSS where malicious content persists in the filter configuration. Insufficient technical detail is available to pinpoint the exact code path responsible.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) reveals:

• High confidentiality impact: The attacker can steal session tokens or sensitive data displayed to the logged-in user.
• Low integrity impact: The attacker can modify content or trigger actions on behalf of the user (e.g., endorsing proposals).
• No availability impact: The attack does not directly cause denial of service.
• Scope changed (S:C): The XSS payload executes within the victim's browser, potentially affecting resources beyond the vulnerable component.

The EPSS score of 0.00736 places this vulnerability in the 51.1th percentile of exploited CVEs, indicating a relatively low but non-zero probability of exploitation in the wild.

Exploitation Scenarios

Step 1 — Reconnaissance and Target Identification: An attacker first identifies Decidim installations. This can be done using search engines (Shodan dorks such as http.title:"Decidim" or http.html:"participatory democracy"), or by scanning for known Decidim application fingerprints. Government and civic participation platforms — the primary users of Decidim — present attractive targets due to their public visibility and the potential for influencing civic actions.

Step 2 — Triggering the Vulnerability: The attacker crafts a malicious URL containing an XSS payload in the processes filter parameter, or injects malicious content into a field that the filter renders. The exact parameter name is not disclosed in the available CVE data. At the vulnerability-class level, the attacker would submit input containing JavaScript code (e.g., <script>alert(1)</script>) within the filter context. If the application fails to encode HTML entities in the reflection point, the payload executes.

Step 3 — Payload Execution: The attacker delivers the crafted URL to a logged-in user via phishing email, social media, or by embedding it in a decoy page. When the victim clicks the link, their browser renders the Decidim page and executes the embedded JavaScript in the context of the Decidim application origin — giving the attacker full access to the victim's session.

No public PoC is available; the attack chain is inferred from the vulnerability class.

Step 4 — Post-Exploitation Impact: The NVD description explicitly states that an attacker "could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing." The malicious JavaScript can programmatically interact with the Decidim DOM to click endorsement buttons, submit support forms, or call internal APIs. Additionally, the attacker could exfiltrate session cookies (if not HttpOnly-protected), scrape personal information visible to the victim, or perform actions that modify the victim's participation profile.

Impact Assessment

Business Impact: For organizations operating Decidim as a civic participation platform, the integrity of the democratic process is the primary asset at risk. An attacker can artificially inflate support for proposals, manipulate voting outcomes, or create false participation records. This undermines trust in the platform and could have legal and reputational consequences for government entities.

Affected Systems: All Decidim deployments running versions prior to 0.27.3 (for the 0.27.x line) or 0.26.7 (for the 0.26.x line). Given that Decidim is used by municipal governments — including Barcelona, Helsinki, and numerous other European cities — the potential blast radius includes thousands of users per installation.

Blast Radius: The CVSS score of 8.1 (High) reflects the combination of network exploitability, low attack complexity, and the high confidentiality impact resulting from scope change (S:C — the vulnerable component affects resources beyond its security scope, i.e., the victim's browser session). The low integrity impact and user interaction requirement moderate the overall severity.

CVSS Subscore Analysis:

• Attack Vector: Network (AV:N) — remotely exploitable
• Attack Complexity: Low (AC:L) — no special conditions required
• Privileges Required: None (PR:N) — unauthenticated attacker
• User Interaction: Required (UI:R) — victim must click a link
• Scope: Changed (S:C) — impact extends beyond the vulnerable component
• Confidentiality: High (C:H) — session/private data exposure
• Integrity: Low (I:L) — limited data modification capability

Detection Guidance

Sigma Rule

title: Decidim Processes Filter XSS Attempt
id: 4f2b9e7d-8c3a-4b5e-9d1f-6a2c8e4b7f0a
status: experimental
description: Detects attempts to exploit CVE-2023-34089 - XSS in Decidim processes filter
author: Valtersit Threat Intelligence
date: 2024/01/15
tags:
    - attack.t1190
    - attack.initial-access
    - cve.2023-34089
logsource:
    category: webserver
    product: apache
    definition: Web server access logs for Decidim deployments
detection:
    selection_payload:
        c-uri|contains:
            - '<script>'
            - 'javascript:'
            - 'onerror='
            - 'onload='
            - '&lt;script&gt;'
            - '%3Cscript%3E'
    selection_filter_path:
        c-uri|contains:
            - '/processes'
            - '/participatory_processes'
            - 'filter'
    condition: selection_payload and selection_filter_path
    timeframe: 5m
level: high
falsepositives:
    - Legitimate security scanner activity
    - Developers testing applications
fields:
    - clientip
    - c-uri
    - c-useragent

YARA Rule

rule Decidim_Processes_Filter_XSS_CVE_2023_34089
{
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2024-01-15"
        description = "Detects XSS payloads targeting Decidim processes filter (CVE-2023-34089)"
        cve = "CVE-2023-34089"
        severity = "high"
    strings:
        $script_tag = "<script>" ascii wide nocase
        $encoded_script = "%3Cscript%3E" ascii wide nocase
        $html_encoded_script = "&lt;script&gt;" ascii wide nocase
        $js_handler1 = "onerror" ascii wide nocase
        $js_handler2 = "onload" ascii wide nocase
        $js_protocol = "javascript:" ascii wide nocase
        $filter_context1 = "/processes" ascii wide
        $filter_context2 = "filter" ascii wide
        $filter_context3 = "participatory_processes" ascii wide
    condition:
        3 of ($script_tag, $encoded_script, $html_encoded_script) and
        1 of ($js_handler*) and
        2 of ($filter_context*) or
        (1 of ($script_tag, $encoded_script, $html_encoded_script) and
         1 of ($js_handler*) and
         2 of ($filter_context*) and
         filesize < 5MB)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET WEB_SERVER Decidim Processes Filter XSS Attempt (CVE-2023-34089)"; flow:established,to_server; content:"/processes"; http_uri; nocase; content:"<script>"; http_uri; nocase; sid:2023408901; rev:1; reference:cve,2023-34089; classtype:web-application-attack; priority:1;)

alert http any any -> $HOME_NET any (msg:"ET WEB_SERVER Decidim Filter Parameter XSS Payload (CVE-2023-34089)"; flow:established,to_server; content:"filter"; http_uri; nocase; pcre:"/(%3C|<)script(%3E|>)/i"; sid:2023408902; rev:1; reference:cve,2023-34089; classtype:web-application-attack; priority:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where event.action == "connection" and destination.port == 443]
  [http where
     (url.path contains "/processes" or url.path contains "/participatory_processes") and
     (url.query contains "<script>" or url.query contains "%3Cscript%3E" or
      url.query contains "javascript:" or url.query contains "onerror" or
      url.query contains "onload")]

Splunk SPL Query

index=web sourcetype=access_combined
  (uri_path="/processes" OR uri_path="*participatory_processes*")
  (uri_query="*<script>*" OR uri_query="*%3Cscript%3E*" OR uri_query="*javascript:*" OR uri_query="*onerror*" OR uri_query="*onload*")
  OR (uri_query="*filter*" AND (uri_query="*&lt;script&gt;*" OR uri_query="*%253Cscript%253E*"))
| eval threat_name="CVE-2023-34089_Decidim_XSS"
| stats count by clientip, uri, useragent, _time
| sort - _time
| table _time, clientip, uri, useragent, count, threat_name

Wazuh OSSEC Rule

<group name="web, decidiom, xss,">
  <rule id="340890" level="12">
    <decoded_as>web</decoded_as>
    <match>processes|participatory_processes</match>
    <regex>(\&lt;|\x3C)script(\&gt;|\x3E)|javascript:|onerror=|onload=</regex>
    <description>Decidim processes filter XSS attempt (CVE-2023-34089)</description>
    <group>attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info type="cve">CVE-2023-34089</info>
    <info type="cwe">CWE-79</info>
    <options>no_full_log</options>
  </rule>

  <rule id="340891" level="12">
    <if_sid>340890</if_sid>
    <regex>filter</regex>
    <description>Decidim XSS in processes filter parameter (CVE-2023-34089)</description>
    <group>attack.t1190,</group>
    <info type="cve">CVE-2023-34089</info>
    <info type="cwe">CWE-79</info>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source). Despite the NVD description stating that "the problem was patched in version 0.27.3 and 0.26.7," no patch sources or vendor advisories were found in tracked sources. This discrepancy should be investigated with the vendor.

1) Immediate Mitigations:

• If running Decidim 0.27.x, upgrade to 0.27.3 or later immediately.
• If running Decidim 0.26.x, upgrade to 0.26.7 or later.
• If immediate upgrade is not possible, deploy a Web Application Firewall (WAF) with rules to block common XSS payload patterns in filter/processes-related URLs.
• Apply Content Security Policy (CSP) headers with script-src 'self' to limit the impact of any script injection. Note that CSP is a defense-in-depth measure and may not fully mitigate all XSS vectors.
• Disable or restrict access to the processes filter feature if it is non-essential to the deployment.

2) Patch/Upgrade Steps:

• Verify the exact Decidim version: bundle show decidim or check Gemfile.lock.
• If a version is below the patched threshold, follow the official Decidim upgrade guide. Contact the Decidim maintainers via their security advisory process for patch details.
• After upgrade, verify the filter feature properly encodes user-controlled input (test with XSS payload strings).
• Update any custom modules or plugins to ensure compatibility with the patched version.

3) Long-Term Hardening:

• Establish a regular patching cadence for Decidim and its Ruby/Rails dependencies.
• Implement a secure development lifecycle that includes SAST and DAST scanning for XSS vulnerabilities.
• Add automated dependency vulnerability scanning to CI/CD pipelines.
• Enable Rails' built-in HTML escaping features and ensure all view templates use proper output encoding.
• Conduct periodic security reviews of all publicly accessible input vectors.
• Monitor CISA KEV and vendor advisories for updates on this CVE; the EPSS data indicates moderate exploitation potential.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-34089 — Official NVD record containing the description, CVSS score, and references.
2. Decidim Official Website: https://decidim.org — Feature information and community resources; relevant for confirming the platform architecture and deployment footprint.
3. Decidim GitHub Repository: https://github.com/decidim/decidim — Source code repository; version history for 0.27.3 and 0.26.7 releases and security fixes.
4. Decidim Forum/Security Advisories: https://meta.decidim.org — Community discussion and security advisory board posts; potential source for additional technical details not present in NVD.

Threat Actor Campaigns: At the time of this report, no known threat actor campaigns specifically exploiting CVE-2023-34089 have been identified. The EPSS score of 0.00736 (51.1th percentile) suggests that exploitation is possible but not yet widespread. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Organizations should continue to monitor threat intelligence sources for indications of in-the-wild exploitation.