CVE-2024-32463

Executive Summary

CVE-2024-32463 is a cross-site scripting (XSS) vulnerability in the Phlex framework for Ruby, which is used for building object-oriented views. The vulnerability allows an attacker to bypass the filter designed to prevent the use of the javascript: URL scheme in the href attribute of an <a> tag. By inserting tab (/t) or newline (/n) characters between the letters of the protocol (e.g., java/tscript:), the filter can be evaded, leading to potential XSS attacks. The vulnerability has a CVSS score of 7.1 (High) and affects multiple versions of Phlex. Patches are available in versions 1.10.1, 1.9.2, 1.8.3, 1.7.2, 1.6.3, 1.5.3, and 1.4.2. Configuring a Content Security Policy (CSP) that does not allow unsafe-inline can effectively prevent exploitation.

Supply Chain & Package Security

This vulnerability affects the Phlex Ruby gem, which is distributed via RubyGems. Organizations using Phlex in their Ruby applications should immediately update to the patched versions. The supply chain risk is moderate, as the vulnerability is in a widely used framework for building views in Ruby. Ensure that your Gemfile references a patched version and that your dependency management pipeline verifies the integrity of the gem.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The vulnerability is exploitable over the network with low complexity, requiring no privileges but user interaction. Successful exploitation can lead to limited confidentiality, integrity, and availability impacts, but the scope change indicates that the vulnerable component impacts resources beyond its security scope.

Deep Dive & Mechanics

The vulnerability lies in the Phlex framework's handling of the href attribute in <a> tags. The framework includes a filter to detect and prevent the use of the javascript: URL scheme to mitigate XSS attacks. However, the filter does not account for tab (/t) or newline (/n) characters inserted between the characters of the protocol. For example, an attacker can craft a URL like java/tscript:alert(1) which bypasses the filter because the filter looks for the exact string javascript: but does not normalize the input by removing whitespace characters.

When a user clicks on such a link, the browser interprets the URL as javascript:alert(1) after stripping the whitespace, leading to XSS. This is a classic example of a filter bypass due to insufficient input sanitization.

Vulnerable vs. Patched Code

Vulnerable Code (Phlex < 1.4.2, < 1.5.3, etc.):

# In the vulnerable version, the filter checks for 'javascript:' but does not normalize whitespace
def sanitize_href(href)
  if href =~ /^javascript:/i
    raise "Blocked javascript: URL"
  end
  href
end

Patched Code (Phlex >= 1.4.2, etc.):

# In the patched version, the filter normalizes whitespace before checking
def sanitize_href(href)
  normalized = href.gsub(/[\t\n\r]/, '')
  if normalized =~ /^javascript:/i
    raise "Blocked javascript: URL"
  end
  href
end

The patched code removes tab, newline, and carriage return characters from the href before performing the check, effectively preventing the bypass.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would craft a malicious link with whitespace characters in the protocol. For example:

<a href="java/tscript:alert('XSS')">Click me</a>

When a user clicks the link, the browser executes the JavaScript. In a real-world scenario, the attacker would inject this into a Phlex view via user input that is not properly sanitized.

Proof of Concept (PoC):

# In a Phlex view
link = "java/tscript:alert(document.cookie)"
a href: link do
  "Click here"
end

Blue Team

To detect exploitation attempts, monitor for unusual patterns in href attributes, such as the presence of tab or newline characters within the protocol. Use the following detection rules.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing href attributes with patterns like java/tscript:, jav/ascript:, or similar variations with whitespace.
  • User-Agent strings that may indicate automated scanning for XSS vulnerabilities.

• File IOCs:

  • Log entries showing attempts to inject javascript: URLs with whitespace characters.
  • Application logs with errors related to sanitize_href or similar functions.

• Behavioral IOCs:

  • Unexpected JavaScript execution in the context of a Phlex application.
  • Unusual outbound network connections from the user's browser.

Detection Engineering

YARA Rule

rule CVE_2024_32463_Phlex_XSS {
    meta:
        description = "Detects attempts to exploit CVE-2024-32463 in Phlex framework"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-32463"
    strings:
        $href_pattern = /href\s*=\s*["'][^"']*j[\t\n\r]*a[\t\n\r]*v[\t\n\r]*a[\t\n\r]*s[\t\n\r]*c[\t\n\r]*r[\t\n\r]*i[\t\n\r]*p[\t\n\r]*t[\t\n\r]*:/i
    condition:
        $href_pattern
}

Sigma Rule

title: CVE-2024-32463 Phlex XSS Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with href attributes containing javascript: protocol with whitespace characters
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - 'java/tscript:'
            - 'jav/ascript:'
            - 'javas/cript:'
    condition: selection
falsepositives:
    - Legitimate use of javascript: URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32463 Phlex XSS Exploitation Attempt"; flow:to_server,established; content:"href"; http_client_body; content:"java"; distance:0; within:10; content:"script:"; distance:0; within:10; pcre:"/href\s*=\s*["'][^"']*j[\t\n\r]*a[\t\n\r]*v[\t\n\r]*a[\t\n\r]*s[\t\n\r]*c[\t\n\r]*r[\t\n\r]*i[\t\n\r]*p[\t\n\r]*t[\t\n\r]*:/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patching: Update Phlex to version 1.10.1, 1.9.2, 1.8.3, 1.7.2, 1.6.3, 1.5.3, or 1.4.2, depending on your current version.
2. Content Security Policy (CSP): Implement a CSP that does not allow unsafe-inline to prevent XSS even if the filter is bypassed.
3. Input Validation: Sanitize all user inputs that are used in href attributes, stripping or rejecting any URLs with javascript: protocol.
4. Web Application Firewall (WAF): Deploy WAF rules to block requests containing javascript: URLs with whitespace characters.
5. Monitoring: Enable logging and monitoring for suspicious href patterns as described in the detection rules.

Valters IT Signature

This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further assistance, contact us at valters@example.com.