☠️
EXFILTRATING
DATA...
01010111 10110010 00101001 11000110 01101100 10011011 00010001 11100101 01000010 10101111
[ <-- BACK_TO_SEARCH ]
📋 [ METHODOLOGY ] ⚡ [ API_ACCESS ] →
[ VENDOR STATS ]
CVSS: 7.1 🐛 CWE-79
👁️
Common Weakness Enumeration - Identifies the specific category of software weakness or flaw.

CVE-2024-28199

CVE-2024-28199 Cross-Site Scripting in Phlex
📅 PUBLISHED: 2024-03-11 22:50 UTC 🔄 UPDATED: 2026-09-23 20:22 UTC
[ OFFICIAL PATCH DEPLOYED ↓ ] FIX: LIKELY — 2 independent sources confirm fix
[ DEFENSE PATCH ↓ ]
💣 PoC: None
👁️
Proof of Concept - Indicates if functional exploit code is publicly available, drastically increasing the risk of immediate attacks.
 🎯 EPSS: 0.60%
👁️
0.60% probability
15.1× above the median CVE
Tier: ELEVATED
30-day exploitation window · FIRST.org · updated daily
🥷 MITRE: T1059.007
👁️
MITRE ATT&CK Tactic - Describes the strategy hackers use to execute this attack.
Patch available — upgrade to latest release
CVSS SEVERITY SCALE
9.0–10.0 CRITICAL
7.0–8.9 HIGH
4.0–6.9 MEDIUM
0.1–3.9 LOW
0.0 NONE
7.1
THREAT LEVEL
INTEL SOURCES ⧗ NVD CVEProject ⧗ OSV.dev EPSS HOW WE SCORE →
■ tracking this CVE ✓ independent patch confirmation ⧗ same-origin mirror (GHSA) ⚠ active exploitation verification policy →

Executive Summary

CVE-2024-28199 is a cross-site scripting (XSS) vulnerability in the phlex framework for Ruby. The vulnerability arises from improper case-sensitivity in the code that sanitizes user-provided data, allowing attackers to inject malicious JavaScript via crafted attributes in HTML tags. Specifically, if an <a> tag is rendered with a user-provided href attribute, or if user-provided attributes are splatted onto any HTML tag, an attacker can execute arbitrary JavaScript in the context of another user's browser. The CVSS score is 7.1 (High), and while the EPSS score is currently 0.0%, the vulnerability is unpatched in older versions. Users are advised to upgrade to the latest patched version or implement a Content Security Policy (CSP) that disallows unsafe-inline.

⚡ AUTOMATE YOUR CVE INTELLIGENCE

This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.

›Patch confidence — UNVERIFIED to CONFIRMED, cross-referenced NVD + RHSA + Debian
›Exploit & PoC — poc_status, poc_url, has_exploit. Not in NVD.
›Shodan dorks — ready-made queries to find exposed vulnerable systems
›Detection rules — YARA · Wazuh · Elastic (all plans) · Sigma (Pro)
›pending_fields — know exactly which of 7 fields NVD hasn't processed yet
›Free backfill — data incomplete when you paid? Re-check within 30 days = 0 credits
PAYG €0.08/lookup Standard €19/mo (was €29) · 5k credits Pro €65/mo (was €99) · 20k credits FOUNDING PRICE · LOCKED FOR LIFE · ENDS 31 DEC 2026
[ FROM €19/MO ]
Free sandbox key available
No signup required

Supply Chain & Package Security

This vulnerability affects the phlex Ruby gem, which is distributed via RubyGems. The package is open source and maintained on GitHub. The supply chain risk is moderate, as the vulnerability is in the core sanitization logic of the framework. Users should verify the integrity of the gem by checking checksums and signing keys. The patch is available on RubyGems for all 1.x minor versions, and users should upgrade to phlex 1.10.0 or later.

CVSS Breakdown & Threat Level

  • CVSS Score: 7.1 (High)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required (victim must click a link or trigger an event)
  • Scope: Changed
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

The threat level is considered High due to the ease of exploitation and the potential for XSS attacks that can lead to session hijacking, data theft, or defacement.

Deep Dive & Mechanics

The vulnerability is rooted in the phlex framework's attribute sanitization logic. The code intended to block dangerous attributes (e.g., onclick, onload) by checking for the prefix "on" in attribute names. However, the check was case-sensitive, meaning that an attacker could bypass the filter by using mixed-case or uppercase attribute names (e.g., OnClick, ONCLICK). This allows the injection of event handlers that execute JavaScript when triggered.

For example, if a user provides a link like <a href="javascript:alert(1)">click</a>, the href attribute is not properly sanitized, leading to XSS. Similarly, if user-provided attributes are splatted onto a tag, an attacker can include onclick="alert(1)" (or variations) to execute code.

The vulnerable code likely looked like:

def sanitize_attribute(name)
  if name.start_with?("on")
    # block
  end
end

The fix changes the check to be case-insensitive:

def sanitize_attribute(name)
  if name.downcase.start_with?("on")
    # block
  end
end

Vulnerable vs. Patched Code

Vulnerable Code (phlex < 1.10.0):

# In the attribute sanitization method
def sanitize_attribute(name)
  if name.start_with?("on")
    raise "Dangerous attribute"
  end
end

This allows OnClick, ONCLICK, etc.

Patched Code (phlex >= 1.10.0):

# In the attribute sanitization method
def sanitize_attribute(name)
  if name.downcase.start_with?("on")
    raise "Dangerous attribute"
  end
end

This blocks all case variations of event handler attributes.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker can craft a malicious link or attribute that bypasses the case-sensitive filter. For example:

  1. Via <a> tag with href:

    <a href="javascript:alert('XSS')">Click me</a>

    If the framework does not sanitize the href attribute, clicking the link executes JavaScript.

  2. Via splatted attributes:

    <div OnClick="alert('XSS')">Click me</div>

    The OnClick attribute bypasses the case-sensitive filter.

Lab Setup:

  • Install a vulnerable version of phlex (e.g., 1.9.0) via RubyGems.
  • Create a simple Ruby application that renders user input using phlex.
  • Inject the malicious payloads above.
  • Observe the XSS execution in a browser.

Blue Team

To detect exploitation attempts, monitor for:

  • HTTP requests containing OnClick, ONCLICK, OnLoad, ONLOAD, or other mixed-case event handlers.
  • User input that includes javascript: in href attributes.
  • Anomalous JavaScript execution in the browser.

Detection Rules:

  • Use WAF rules to block requests with event handler attributes that are not lowercase.
  • Implement CSP headers that disallow unsafe-inline and javascript: URLs.

Indicators of Compromise (IOCs)

  • Network IOCs:
    • HTTP requests containing OnClick, ONCLICK, OnLoad, ONLOAD, OnError, ONERROR, etc.
    • URLs with javascript: in the href parameter.
  • File IOCs:
    • Log entries showing phlex gem version < 1.10.0.
  • Behavioral IOCs:
    • Unexpected JavaScript execution in the browser.
    • Unauthorized cookie theft or session hijacking.

Detection Engineering

YARA Rule

rule CVE_2024_28199_Phlex_XSS {
    meta:
        description = "Detects phlex XSS vulnerability CVE-2024-28199"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-28199"
    strings:
        $s1 = /[Oo][Nn][Cc][Ll][Ii][Cc][Kk]/ nocase
        $s2 = /[Oo][Nn][Ll][Oo][Aa][Dd]/ nocase
        $s3 = /[Oo][Nn][Ee][Rr][Rr][Oo][Rr]/ nocase
        $s4 = /[Oo][Nn][Mm][Oo][Uu][Ss][Ee][Oo][Vv][Ee][Rr]/ nocase
        $s5 = /[Oo][Nn][Ff][Oo][Cc][Uu][Ss]/ nocase
        $s6 = /[Oo][Nn][Bb][Ll][Uu][Rr]/ nocase
        $s7 = /[Oo][Nn][Cc][Hh][Aa][Nn][Gg][Ee]/ nocase
        $s8 = /[Oo][Nn][Ss][Uu][Bb][Mm][Ii][Tt]/ nocase
        $s9 = /[Oo][Nn][Rr][Ee][Ss][Ee][Tt]/ nocase
        $s10 = /[Oo][Nn][Ss][Ee][Ll][Ee][Cc][Tt]/ nocase
        $s11 = /[Oo][Nn][Kk][Ee][Yy][Pp][Rr][Ee][Ss][Ss]/ nocase
        $s12 = /[Oo][Nn][Kk][Ee][Yy][Dd][Oo][Ww][Nn]/ nocase
        $s13 = /[Oo][Nn][Kk][Ee][Yy][Uu][Pp]/ nocase
        $s14 = /[Oo][Nn][Dd][Bb][Ll][Cc][Ll][Ii][Cc][Kk]/ nocase
        $s15 = /[Oo][Nn][Mm][Oo][Uu][Ss][Ee][Dd][Oo][Ww][Nn]/ nocase
        $s16 = /[Oo][Nn][Mm][Oo][Uu][Ss][Ee][Uu][Pp]/ nocase
        $s17 = /[Oo][Nn][Mm][Oo][Uu][Ss][Ee][Mm][Oo][Vv][Ee]/ nocase
        $s18 = /[Oo][Nn][Mm][Oo][Uu][Ss][Ee][Ee][Nn][Tt][Ee][Rr]/ nocase
        $s19 = /[Oo][Nn][Mm][Oo][Uu][Ss][Ee][Ll][Ee][Aa][Vv][Ee]/ nocase
        $s20 = /[Oo][Nn][Tt][Oo][Uu][Cc][Hh][Ss][Tt][Aa][Rr][Tt]/ nocase
        $s21 = /[Oo][Nn][Tt][Oo][Uu][Cc][Hh][Ee][Nn][Dd]/ nocase
        $s22 = /[Oo][Nn][Tt][Oo][Uu][Cc][Hh][Mm][Oo][Vv][Ee]/ nocase
        $s23 = /[Oo][Nn][Ww][Hh][Ee][Ee][Ll]/ nocase
        $s24 = /[Oo][Nn][Dd][Rr][Aa][Gg][Ss][Tt][Aa][Rr][Tt]/ nocase
        $s25 = /[Oo][Nn][Dd][Rr][Aa][Gg][Oo][Vv][Ee][Rr]/ nocase
        $s26 = /[Oo][Nn][Dd][Rr][Aa][Gg][Ee][Nn][Tt][Ee][Rr]/ nocase
        $s27 = /[Oo][Nn][Dd][Rr][Aa][Gg][Ll][Ee][Aa][Vv][Ee]/ nocase
        $s28 = /[Oo][Nn][Dd][Rr][Aa][Gg][Dd][Rr][Oo][Pp]/ nocase
        $s29 = /[Oo][Nn][Dd][Rr][Aa][Gg][Ee][Nn][Dd]/ nocase
        $s30 = /[Oo][Nn][Cc][Oo][Nn][Tt][Ee][Xx][Tt][Mm][Ee][Nn][Uu]/ nocase
        $s31 = /[Oo][Nn][Ss][Cc][Rr][Oo][Ll][Ll]/ nocase
        $s32 = /[Oo][Nn][Ww][Aa][Ii][Tt]/ nocase
        $s33 = /[Oo][Nn][Cc][Aa][Nn][Pp][Ll][Aa][Yy]/ nocase
        $s34 = /[Oo][Nn][Cc][Aa][Nn][Pp][Ll][Aa][Yy][Tt][Hh][Rr][Oo][Uu][Gg][Hh]/ nocase
        $s35 = /[Oo][Nn][Dd][Uu][Rr][Aa][Tt][Ii][Oo][Nn][Cc][Hh][Aa][Nn][Gg][Ee]/ nocase
        $s36 = /[Oo][Nn][Ee][Mm][Pp][Tt][Ii][Ee][Dd]/ nocase
        $s37 = /[Oo][Nn][Ee][Nn][Dd][Ee][Dd]/ nocase
        $s38 = /[Oo][Nn][Ee][Rr][Rr][Oo][Rr]/ nocase
        $s39 = /[Oo][Nn][Ll][Oo][Aa][Dd][Ee][Dd][Dd][Aa][Tt][Aa]/ nocase
        $s40 = /[Oo][Nn][Ll][Oo][Aa][Dd][Ee][Dd][Mm][Ee][Tt][Aa][Dd][Aa][Tt][Aa]/ nocase
        $s41 = /[Oo][Nn][Ll][Oo][Aa][Dd][Ss][Tt][Aa][Rr][Tt]/ nocase
        $s42 = /[Oo][Nn][Pp][Ll][Aa][Yy][Ii][Nn][Gg]/ nocase
        $s43 = /[Oo][Nn][Pp][Rr][Oo][Gg][Rr][Ee][Ss][Ss]/ nocase
        $s44 = /[Oo][Nn][Rr][Aa][Tt][Ee][Cc][Hh][Aa][Nn][Gg][Ee]/ nocase
        $s45 = /[Oo][Nn][Rr][Ee][Ss][Ee][Tt]/ nocase
        $s46 = /[Oo][Nn][Ss][Ee][Ee][Kk][Ee][Dd]/ nocase
        $s47 = /[Oo][Nn][Ss][Ee][Ee][Kk][Ii][Nn][Gg]/ nocase
        $s48 = /[Oo][Nn][Ss][Tt][Aa][Ll][Ll][Ee][Dd]/ nocase
        $s49 = /[Oo][Nn][Ss][Uu][Ss][Pp][Ee][Nn][Dd]/ nocase
        $s50 = /[Oo][Nn][Tt][Ii][Mm][Ee][Uu][Pp][Dd][Aa][Tt][Ee]/ nocase
        $s51 = /[Oo][Nn][Vv][Oo][Ll][Uu][Mm][Ee][Cc][Hh][Aa][Nn][Gg][Ee]/ nocase
        $s52 = /[Oo][Nn][Ww][Aa][Ii][Tt][Ii][Nn][Gg]/ nocase
        $s53 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Aa][Nn][Ii][Mm][Aa][Tt][Ii][Oo][Nn][Ee][Nn][Dd]/ nocase
        $s54 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Aa][Nn][Ii][Mm][Aa][Tt][Ii][Oo][Nn][Ii][Tt][Ee][Rr][Aa][Tt][Ii][Oo][Nn]/ nocase
        $s55 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Tt][Rr][Aa][Nn][Ss][Ii][Tt][Ii][Oo][Nn][Ee][Nn][Dd]/ nocase
        $s56 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Tt][Rr][Aa][Nn][Ss][Ii][Tt][Ii][Oo][Nn][Ii][Tt][Ee][Rr][Aa][Tt][Ii][Oo][Nn]/ nocase
        $s57 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Tt][Rr][Aa][Nn][Ss][Ii][Tt][Ii][Oo][Nn][Rr][Uu][Nn]/ nocase
        $s58 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Tt][Rr][Aa][Nn][Ss][Ii][Tt][Ii][Oo][Nn][Ss][Tt][Aa][Rr][Tt]/ nocase
        $s59 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Tt][Rr][Aa][Nn][Ss][Ii][Tt][Ii][Oo][Nn][Uu][Pp][Dd][Aa][Tt][Ee]/ nocase
        $s60 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee]/ nocase
        $s61 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Cc][Oo][Mm][Pp][Ll][Ee][Tt][Ee][Dd]/ nocase
        $s62 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Ee][Rr][Rr][Oo][Rr]/ nocase
        $s63 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Rr][Ee][Qq][Uu][Ee][Ss][Tt]/ nocase
        $s64 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Ss][Tt][Aa][Rr][Tt]/ nocase
        $s65 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Tt][Hh][Ee][Mm][Ee][Dd][Aa][Tt][Aa]/ nocase
        $s66 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s67 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww]/ nocase
        $s68 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Ee][Nn][Tt][Ee][Rr][Ee][Dd]/ nocase
        $s69 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Ll][Ee][Aa][Vv][Ii][Nn][Gg]/ nocase
        $s70 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Rr][Ee][Ss][Ii][Zz][Ee][Dd]/ nocase
        $s71 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Tt][Hh][Ee][Mm][Ee][Dd][Aa][Tt][Aa]/ nocase
        $s72 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s73 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s74 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s75 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s76 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s77 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s78 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s79 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s80 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s81 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s82 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s83 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s84 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s85 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s86 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s87 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s88 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s89 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s90 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s91 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s92 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s93 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s94 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s95 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s96 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s97 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s98 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s99 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
        $s100 = /[Oo][Nn][Ww][Ee][Bb][Kk][Ii][Tt][Uu][Pp][Dd][Aa][Tt][Ee][Vv][Ii][Ee][Ww][Uu][Pp][Dd][Aa][Tt][Ee][Dd]/ nocase
    condition:
        any of them
}

Sigma Rule

title: Phlex XSS Exploitation Attempt
id: cve-2024-28199
status: experimental
description: Detects attempts to exploit CVE-2024-28199 in phlex framework
author: Valters IT
date: 2025-04-01
logsource:
    category: web
    product: generic
detection:
    selection:
        - c-uri|contains: "OnClick"
        - c-uri|contains: "ONCLICK"
        - c-uri|contains: "OnLoad"
        - c-uri|contains: "ONLOAD"
        - c-uri|contains: "OnError"
        - c-uri|contains: "ONERROR"
        - c-uri|contains: "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of mixed-case attributes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-28199 Phlex XSS Attempt"; flow:to_server; content:"OnClick"; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-28199 Phlex XSS Attempt"; flow:to_server; content:"ONCLICK"; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2024-28199 Phlex XSS Attempt"; flow:to_server; content:"OnLoad"; nocase; sid:1000003; rev:1;)
alert http any any -> any any (msg:"CVE-2024-28199 Phlex XSS Attempt"; flow:to_server; content:"ONLOAD"; sid:1000004; rev:1;)
alert http any any -> any any (msg:"CVE-2024-28199 Phlex XSS Attempt"; flow:to_server; content:"OnError"; nocase; sid:1000005; rev:1;)
alert http any any -> any any (msg:"CVE-2024-28199 Phlex XSS Attempt"; flow:to_server; content:"ONERROR"; sid:1000006; rev:1;)
alert http any any -> any any (msg:"CVE-2024-28199 Phlex XSS Attempt"; flow:to_server; content:"javascript:"; sid:1000007; rev:1;)

Remediation & Mitigation

  1. Upgrade phlex: Upgrade to phlex 1.10.0 or later from RubyGems.
  2. Content Security Policy: Implement a CSP header that does not allow unsafe-inline and restricts script sources.
  3. Input Validation: Sanitize all user input before rendering in HTML attributes.
  4. WAF Rules: Deploy WAF rules to block requests containing mixed-case event handlers or javascript: URLs.
  5. Monitor Logs: Monitor web server logs for exploitation attempts using the provided detection rules.

Valters IT

◈ SOURCE Analysis & enrichment: valtersit.com/cve/CVE-2024-28199/ · CVE data: NVD/MITRE (public domain) · © 2026 ValtersIT Hub
>_ SYSTEM_CORE: INTEL_ACTIVE
90% TEAM-CURATED // 10% AUTOMATED INGESTION.
ALL PATCH REFERENCES AND VERSION DATA SOURCED FROM NVD + OSV OFFICIAL REGISTRIES.