CVE-2024-23055

Executive Summary

CVE-2024-23055 is a Host Header Injection vulnerability in the Plone Docker Official Image version 5.2.13 (5221). The vulnerability arises from improper validation of the Host header, allowing an attacker to inject arbitrary values that are reflected in the server's response. This can be leveraged for Cross-Site Scripting (XSS) attacks, potentially leading to session hijacking, credential theft, or further exploitation. The vulnerability has a CVSS v3.1 score of 6.1 (Medium), with a public proof-of-concept (PoC) available via a Nuclei template. No official patch has been released, making this a significant risk for deployments using the affected version.

Supply Chain & Package Security

This vulnerability affects the official Docker image for Plone, a widely used content management system. The supply chain risk is elevated because the vulnerable image is distributed via Docker Hub and may be pulled automatically in CI/CD pipelines or production environments. Organizations using this image should immediately audit their deployments and consider pinning to a specific, patched version if available, or implementing compensating controls.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): Required (R) - Victim must visit a crafted link or page.
• Scope (S): Changed (C) - Impact may extend beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited information disclosure.
• Integrity (I): Low (L) - Limited ability to modify content.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the existence of a public PoC and the lack of a patch increase the urgency. The vulnerability can be chained with other attacks to achieve remote code execution (RCE) as described in the original advisory.

Deep Dive & Mechanics

The vulnerability is a classic Host Header Injection. When a request is sent to the Plone server with a malicious Host header, the server reflects this value in the response without proper sanitization. This is particularly dangerous because the Host header is often used to generate URLs, redirects, and other dynamic content.

Attack Flow:

1. An attacker crafts an HTTP request with a malicious Host header (e.g., Host: attacker.com).
2. The Plone server processes the request and includes the attacker-controlled Host value in the response body, often in the PORTAL_URL variable or similar.
3. If the attacker can trick a victim into making a request (e.g., via a crafted link or a cross-site request), the malicious Host value will be executed in the victim's browser context, leading to XSS.

Root Cause: The application fails to validate or sanitize the Host header before using it in the response. This is a common oversight in web applications that rely on the Host header for URL generation without considering that it can be manipulated.

Vulnerable vs. Patched Code

Vulnerable Code (Plone Docker 5.2.13): The vulnerable code likely uses the Host header directly in template rendering or URL generation without validation. For example:

# Vulnerable: Direct use of Host header
portal_url = request.get('HTTP_HOST', '')
response_body = f"<a href='{portal_url}'>Click here</a>"

Patched Code (Hypothetical): A patched version would validate the Host header against a whitelist of allowed domains or sanitize it to prevent injection.

# Patched: Validate Host header
allowed_hosts = ['example.com', 'plone.example.com']
host = request.get('HTTP_HOST', '')
if host not in allowed_hosts:
    host = 'default.example.com'
response_body = f"<a href='{host}'>Click here</a>"

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Plone Docker instance (version 5.2.13).
• A tool like curl or Burp Suite.
• The Nuclei template for automated scanning.

Manual Exploitation:

1. Start a vulnerable Plone Docker container:

   docker run -d -p 8080:8080 plone:5.2.13
   

2. Send a crafted request with a malicious Host header:

   curl -H "Host: <script>alert('XSS')</script>.tld" http://localhost:8080/
   

3. Observe the response for the injected script.

Automated Exploitation with Nuclei: Use the provided Nuclei template to scan for the vulnerability:

nuclei -t CVE-2024-23055.yaml -u http://localhost:8080/

Exploit-DB Code: None available.

Blue Team (Defensive)

Detection:

• Monitor for unusual Host headers in HTTP requests, especially those containing script tags or unusual domains.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Implement a Web Application Firewall (WAF) rule to block requests with suspicious Host headers.
• Apply input validation on the server side to sanitize the Host header.
• If possible, upgrade to a patched version of Plone or apply a vendor-supplied fix.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with Host headers containing script tags, unusual domains, or random strings (e.g., {{randstr}}.tld).
  • Responses containing the injected Host value in the body, particularly in PORTAL_URL or similar variables.
• File IOCs:
  • Log entries showing requests with anomalous Host headers.
• System IOCs:
  • Unexpected redirects or content injection in the Plone application.

Detection Engineering

YARA Rule

rule CVE_2024_23055_Plone_Host_Header_Injection {
    meta:
        description = "Detects Host Header Injection attempts against Plone Docker 5.2.13"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-23055"
    strings:
        $host_injection = /Host:\s*[^\r\n]*<script[^>]*>/
        $portal_url = /PORTAL_URL/
    condition:
        $host_injection and $portal_url
}

Sigma Rule

title: Plone Host Header Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with malicious Host headers targeting Plone Docker
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-host|contains:
            - '<script'
            - 'javascript:'
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate use of unusual Host headers in testing environments
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-23055 Plone Host Header Injection Attempt"; flow:to_server,established; content:"Host|3a|"; nocase; pcre:"/Host:\s*[^\r\n]*<script[^>]*>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2024-23055

info:
  name: Plone Docker - Host Header Injection
  author: theamanrawat
  severity: medium
  description: |
    Plone Docker Official Image 5.2.13 (5221) is vulnerable to Host Header Injection due to improper validation of input by the HOST headers. This can lead to Cross-Site Scripting (XSS) attacks when the malicious Host header value is reflected in the response.
  impact: |
    Remote attackers can execute arbitrary code on the server, potentially leading to full system compromise.
  remediation: |
    Update to the latest version of Plone Docker or apply security patches addressing HOST header validation.
  reference:
    - https://github.com/c0d3x27/CVEs/tree/main/CVE-2024-23055
    - https://github.com/advisories/GHSA-fpqg-fv5v-vhpr
    - https://nvd.nist.gov/vuln/detail/CVE-2024-23055
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2024-23055
    epss-score: 0.0403
    epss-percentile: 0.88523
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.component:"Plone"
  tags: cve,cve2024,plone,xss,host-header,injection

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{randstr}}.tld

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{{randstr}}.tld'
          - 'PORTAL_URL'
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200
# digest: 490a00463044022009c3e9b041e7a3a685e1cb4fe0f9eef0c3102bdb2120b21f567ca4cf102886d1022048aa7fff96d65df2f8ee8d053866257cc513fa20edc88b2bbe1346e092f45cb8:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Isolate Vulnerable Instances: If possible, take the affected Plone Docker containers offline or restrict network access.
2. Implement WAF Rules: Deploy a Web Application Firewall (e.g., ModSecurity) with rules to block malicious Host headers.
3. Input Validation: Modify the application code to validate the Host header against a whitelist of allowed domains.

Long-Term Fix:

• Upgrade: Monitor the Plone project for an official patch or updated Docker image. Apply it as soon as it becomes available.
• Code Review: Conduct a security review of the codebase to identify and fix similar injection vulnerabilities.
• Container Hardening: Use Docker security best practices, such as running containers with minimal privileges and using read-only filesystems.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For further assistance, contact Secure Channels (Signal / Portal).

{/* [Security Hash: B58196D9FCA9FA6B20BBEFF4] */}