CVE-2024-28100

Executive Summary

CVE-2024-28100 is a critical Stored Cross-Site Scripting (XSS) vulnerability in eLabFTW, an open-source electronic lab notebook. A regular authenticated user can upload a specially crafted file that, when viewed in a list of experiments by another user (including a sysadmin), executes arbitrary JavaScript in the victim's browser. This allows the attacker to perform any action the victim can, including creating API keys, modifying experiments, or, if the victim is a sysadmin, performing full system configuration and user management. The vulnerability is unpatched in versions prior to 5.0.0, and no workarounds exist. The CVSS score is 8.9 (High), and while the EPSS score is currently 0.0%, the impact is severe due to the potential for privilege escalation and persistent compromise.

Supply Chain & Package Security

eLabFTW is a PHP application distributed via GitHub and Docker. This vulnerability is not a supply chain attack on a package manager (e.g., NPM, PyPI), but rather a direct vulnerability in the application's file upload and rendering logic. Users should verify the integrity of their eLabFTW installation and ensure they are not running forked or modified versions that may not have the fix.

CVSS Breakdown & Threat Level

• CVSS Score: 8.9 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
• Attack Vector (AV): Network (N) - The attack is carried out over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - The attacker needs a valid user account.
• User Interaction (UI): Required (R) - The victim must view the list of experiments.
• Scope (S): Changed (C) - The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): High (H) - Full data access is possible.
• Integrity (I): High (H) - Full data modification is possible.
• Availability (A): High (H) - Full system control is possible.

Threat Level: Critical. While the EPSS score is low, the impact is severe, and the attack vector is straightforward for any authenticated user.

Deep Dive & Mechanics

The vulnerability lies in how eLabFTW handles file uploads and renders them in the experiment list view. A regular user can upload a file (e.g., an image, PDF, or other document) that contains embedded JavaScript. When another user views the list of experiments, the application does not properly sanitize the file's metadata or content, allowing the malicious script to execute in the context of the victim's browser.

Attack Flow:

1. Authentication: The attacker logs in as a regular user.
2. File Upload: The attacker uploads a file (e.g., malicious.svg or payload.html) containing a JavaScript payload (e.g., <script>alert('XSS')</script>).
3. Trigger: The attacker ensures the file is associated with an experiment that will appear in a list.
4. Victim Action: A victim (any user, including a sysadmin) navigates to the experiment list page.
5. Execution: The browser renders the malicious file, executing the JavaScript.
6. Impact: The script can perform actions on behalf of the victim, such as creating API keys, modifying experiments, or, if the victim is a sysadmin, changing system settings.

Root Cause: Lack of proper input validation and output encoding for uploaded file content and metadata.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-5.0.0): The application likely directly outputs file metadata or content without sanitization. For example, in a PHP view file:

// Vulnerable: Direct output of file name
echo '<div class="file-name">' . $file->getName() . '</div>';

Patched Code (5.0.0+): The fix involves proper HTML encoding and content-type validation:

// Patched: HTML-encoded output
echo '<div class="file-name">' . htmlspecialchars($file->getName(), ENT_QUOTES, 'UTF-8') . '</div>';

Additionally, file uploads should be validated to ensure they match expected MIME types and do not contain executable scripts.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account on an eLabFTW instance (version < 5.0.0).
• Ability to upload files.

Exploitation Steps:

1. Craft Payload: Create a file (e.g., payload.svg) containing:

   <?xml version="1.0" encoding="UTF-8"?>
   <svg xmlns="http://www.w3.org/2000/svg">
     <script>alert('XSS')</script>
   </svg>
   

2. Upload: Log in to eLabFTW and upload the file to an experiment.
3. Trigger: Share the experiment link with the victim or wait for them to view the experiment list.
4. Escalate: Use the XSS to create an API key for persistence:

   fetch('/api/v2/api_keys', {
     method: 'POST',
     headers: {'Content-Type': 'application/json'},
     body: JSON.stringify({name: 'backdoor', can_write: true})
   });
   

Note: No public exploit code is available at this time.

Blue Team

Detection:

• Monitor for unusual file uploads (e.g., SVG, HTML files) by regular users.
• Look for API key creation events from non-admin users.
• Use the detection rules below.

Hunting:

• Search logs for POST /api/v2/api_keys requests.
• Review uploaded files for embedded scripts.

Indicators of Compromise (IOCs)

• File Hashes: (None available, but monitor for files with embedded scripts)
• Network: Outbound connections to attacker-controlled domains from the eLabFTW server.
• Logs: Unusual API key creation events.
• Files: Uploaded files with MIME types like image/svg+xml or text/html containing <script> tags.

Detection Engineering

YARA Rule

rule CVE_2024_28100_Stored_XSS {
    meta:
        description = "Detects files with embedded JavaScript that may exploit CVE-2024-28100"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-28100"
    strings:
        $script = /<script[\s>]/ nocase
        $onload = /onload\s*=/ nocase
        $onerror = /onerror\s*=/ nocase
    condition:
        any of them
}

Sigma Rule

title: Suspicious File Upload with Embedded Script
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects upload of files containing script tags, potential CVE-2024-28100 exploitation
author: Valters IT
logsource:
    category: file_event
    product: linux
detection:
    selection:
        EventID: 11  # File creation
        TargetFilename|contains: '/uploads/'
        TargetFilename|endswith:
            - '.svg'
            - '.html'
            - '.htm'
    condition: selection
falsepositives:
    - Legitimate SVG files with scripts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-28100 - Potential Stored XSS via File Upload"; flow:to_server,established; content:"POST"; http_method; content:"/api/v2/"; http_uri; content:"upload"; http_uri; pcre:"/<script[\s>]/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade: Update eLabFTW to version 5.0.0 or later.
2. Restrict Uploads: If upgrade is not possible, disable file uploads for regular users.
3. Web Application Firewall (WAF): Deploy WAF rules to block uploads containing script tags.

Long-term:

• Implement Content Security Policy (CSP) headers to mitigate XSS.
• Conduct regular security audits of file upload functionality.
• Enforce strict MIME type validation and file content scanning.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.