CVE-2024-27092

Executive Summary

CVE-2024-27092 is a medium-severity vulnerability in Hoppscotch, an open-source API development ecosystem. The flaw resides in the Team Name (Label) field within the "Edit Team" functionality. Due to a lack of input validation, an attacker can inject arbitrary HTML and external links into this field. When a team member views the team settings or receives a notification, the injected content is rendered as a clickable link, enabling phishing attacks that spoof Hoppscotch branding. The CVSS score is 5.4 (Medium), and the vulnerability is patched in version 2023.12.6. No public exploit code or Nuclei template is available at this time.

Supply Chain & Package Security

Hoppscotch is a web application typically deployed via Docker or self-hosted Node.js. The vulnerability does not directly affect the software supply chain (e.g., npm packages), but it does impact the integrity of communications within the platform. Organizations using Hoppscotch should ensure they are running version 2023.12.6 or later to prevent spoofed team invitations or notifications.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – An unauthenticated attacker can exploit this if they can create or edit a team.
• User Interaction (UI): Required (R) – The victim must click the malicious link.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited information disclosure possible.
• Integrity (I): Low (L) – The attacker can spoof content but not modify system data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. It is primarily a phishing vector.

Deep Dive & Mechanics

The vulnerability exists in the team editing functionality of Hoppscotch. When a user creates or edits a team, the "Label" (Team Name) field is not sanitized. An attacker can input a string containing HTML tags, such as <a href="http://malicious.com">Click here</a>. This input is stored in the database and later rendered in the Hoppscotch UI without proper escaping. When a team member views the team settings or receives an email notification, the malicious link is displayed as clickable text, appearing to originate from Hoppscotch.

The attack flow:

1. Attacker creates a team or edits an existing team's name.
2. Attacker sets the team name to something like Important Update <a href="http://evil.com">Verify Account</a>.
3. Victim receives a notification or views the team page.
4. Victim sees a legitimate-looking link and clicks it.
5. Victim is redirected to a phishing site that mimics Hoppscotch's login page.

Vulnerable vs. Patched Code

Vulnerable Code (before 2023.12.6):

// No sanitization on team name input
const teamName = req.body.name;
// Directly stored and rendered
db.saveTeam({ name: teamName });

Patched Code (2023.12.6):

// Input validation and sanitization
const sanitizedTeamName = sanitizeHtml(req.body.name, {
  allowedTags: [],
  allowedAttributes: {}
});
db.saveTeam({ name: sanitizedTeamName });

The patch uses a sanitization library (e.g., sanitize-html) to strip all HTML tags from the team name before storage and rendering.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Setup: Deploy a vulnerable Hoppscotch instance (version < 2023.12.6) locally using Docker.

   docker run -d -p 3000:3000 hoppscotch/hoppscotch:2023.12.5
   

2. Create a malicious team:
   • Log in as any user.
   • Navigate to "Teams" → "Create Team".
   • Set the team name to: Security Alert <a href="http://attacker.com/phish">Click to Verify</a>
   • Save the team.
3. Invite a victim: Add a victim user to the team.
4. Trigger: The victim will see the malicious link in the team list or notification. When clicked, they are redirected to the attacker's phishing site.

Blue Team (Detection & Hardening)

1. Monitor for suspicious team names: Look for HTML tags or unusual characters in team creation/update logs.
2. Deploy WAF rules: Block requests containing <a href or similar patterns in the team name field.
3. User education: Train users to verify URLs before clicking, even if they appear to come from Hoppscotch.
4. Update immediately: Ensure all Hoppscotch instances are running version 2023.12.6 or later.

Indicators of Compromise (IOCs)

• Network: Outbound connections to domains not associated with Hoppscotch (e.g., evil.com, phish.net).
• Logs: Team names containing HTML tags like <a, <img, <script>.
• Email: Notifications from Hoppscotch containing clickable links that do not match the legitimate Hoppscotch domain.
• File: No specific file-based IOCs.

Detection Engineering

YARA Rule

rule Detect_Hoppscotch_Phishing_TeamName {
    meta:
        description = "Detects malicious team names in Hoppscotch logs containing HTML anchor tags"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-27092"
    strings:
        $html_tag = /<a\s+href\s*=\s*["']?[^"']*["']?\s*>/i
        $team_name = /team.*name.*<a/i
    condition:
        $html_tag or $team_name
}

Sigma Rule

title: Hoppscotch Malicious Team Name Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to create or update a Hoppscotch team with HTML anchor tags in the name field.
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-27092
logsource:
    category: application
    product: hoppscotch
detection:
    selection:
        event: "team_created" or "team_updated"
        team_name|contains: "<a href"
    condition: selection
falsepositives:
    - Legitimate use of HTML in team names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-27092 Hoppscotch Malicious Team Name Injection";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/team"; http_uri;
    content:"name"; http_client_body;
    pcre:"/<a\s+href\s*=\s*[\x22\x27]?http/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-27092;
)

Remediation & Mitigation

1. Immediate: Upgrade Hoppscotch to version 2023.12.6 or later.
2. Compensating Controls: If upgrade is not possible, implement a reverse proxy (e.g., Nginx) to filter requests containing HTML tags in the team name field.

   location /api/team {
       if ($request_body ~* "<a href") {
           return 403;
       }
   }
   

3. User Awareness: Conduct phishing simulations to educate users about spoofed links.
4. Monitoring: Enable logging for all team creation and update events, and alert on suspicious patterns.

Valters IT