CVE-2024-32970

Executive Summary

CVE-2024-32970 is a Cross-Site Scripting (XSS) vulnerability in the Phlex framework for Ruby, which is used for building object-oriented views. The vulnerability arises from the framework's failure to properly sanitize user-provided data when rendering HTML attributes, specifically in <a> tags with href attributes and when "splatting" user-provided attributes onto any HTML or SVG tag. This allows an attacker to inject malicious JavaScript code that executes when a victim interacts with the crafted element (e.g., clicking a link or triggering an event). The CVSS score is 7.1 (High), and while no public proof-of-concept (PoC) or exploit code is available, the attack vector is well-understood and can be exploited via crafted user input. The vendor has released patches, and a Content Security Policy (CSP) without unsafe-inline can mitigate the risk for those unable to upgrade.

Supply Chain & Package Security

This vulnerability affects the Phlex Ruby gem, which is distributed via RubyGems. The supply chain risk is moderate, as the gem is used in web applications that render user-controlled data. An attacker could inject malicious payloads through user input fields, comments, or any data that is rendered using Phlex views. The patch is available on RubyGems, and users are strongly advised to update their dependencies. Organizations should verify their Gemfile.lock to ensure they are not using an affected version and should consider implementing a CSP as a defense-in-depth measure.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must click a link or trigger an event.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited modification of data.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: High. The vulnerability is easy to exploit (low complexity, no privileges required) and can lead to session hijacking, data theft, or defacement. The lack of a public PoC reduces immediate risk, but the attack vector is well-documented.

Deep Dive & Mechanics

The Phlex framework escapes user data by default, but the escape mechanism was insufficient for HTML attributes. Specifically:

1. <a> tag with href attribute: When rendering a link like <a href="<%= user_input %>">, the framework escaped the value but did not prevent the use of javascript: protocol. For example, javascript:alert(1) would be rendered as <a href="javascript:alert(1)">, which executes JavaScript when clicked.

2. Splatting user-provided attributes: When using the splat operator (**) to pass user-controlled attributes to any HTML or SVG tag, an attacker could inject event handlers like onclick, onmouseover, etc. For example, {onclick: "alert(1)"} would be rendered as <div onclick="alert(1)">, executing the script when the event is triggered.

The root cause is that the framework's escaping logic did not account for the permissive nature of browsers, which allow JavaScript execution via javascript: URLs in href attributes and via event handler attributes. The developers have since added extensive browser tests and a list of 6613 known XSS payloads to prevent such issues.

Vulnerable vs. Patched Code

Vulnerable Code (Phlex < 2.11.0):

# In a view component
def link_to(url, text)
  a(href: url) { text }
end

# User input: url = "javascript:alert(1)"
# Rendered: <a href="javascript:alert(1)">Click me</a>

Patched Code (Phlex >= 2.11.0):

# The framework now sanitizes href attributes to block javascript: and other dangerous protocols
def link_to(url, text)
  a(href: sanitize_url(url)) { text }
end

# For splatted attributes, event handlers are stripped or escaped
def render_with_attributes(**attrs)
  div(**sanitize_attributes(attrs)) { content }
end

The patch introduces sanitize_url and sanitize_attributes methods that:

• Block dangerous URL schemes (e.g., javascript:, data:, vbscript:).
• Remove or escape event handler attributes (e.g., onclick, onload).

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Setup:

1. Install a vulnerable version of Phlex: gem install phlex -v 2.10.0
2. Create a simple Ruby web application using Sinatra and Phlex:

   require 'sinatra'
   require 'phlex'
   
   class MyView < Phlex::HTML
     def initialize(user_input)
       @user_input = user_input
     end
   
     def template
       a(href: @user_input) { "Click me" }
     end
   end
   
   get '/' do
     MyView.new(params[:url]).call
   end
   

3. Run the app: ruby app.rb

Exploitation:

• Attack 1 (javascript: URL): Visit http://localhost:4567/?url=javascript:alert(document.cookie). Clicking the link triggers an alert with cookies.
• Attack 2 (Event handler via splat): Modify the view to accept splatted attributes:

  def template
    div(**@user_input) { "Hover over me" }
  end
  

  Visit http://localhost:4567/?onmouseover=alert(1). Hovering over the div triggers the alert.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual URL parameters containing javascript:, data:, or event handler names (e.g., onclick, onload).
• Use Web Application Firewall (WAF) rules to block requests with javascript: in query parameters.
• Implement Content Security Policy (CSP) headers: Content-Security-Policy: default-src 'self'; script-src 'self'; (avoid unsafe-inline).

Hunting:

• Search logs for patterns like href=javascript: or onclick= in user-supplied data.
• Use the Sigma rule below to detect exploitation attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Requests containing javascript: in URL parameters (e.g., ?url=javascript:alert(1)).
  • Requests with event handler attributes in POST/GET data (e.g., onclick=alert(1)).
• File IOCs:
  • Log entries showing href="javascript: or onclick= in rendered HTML.
• Behavioral IOCs:
  • Unexpected JavaScript execution in the browser (e.g., alerts, redirects).
  • Unusual CSP violation reports (if CSP is enabled).

Detection Engineering

YARA Rule

rule CVE_2024_32970_Phlex_XSS {
   meta:
      description = "Detects potential XSS payloads targeting Phlex href and event handler attributes"
      author = "Valters IT"
      date = "2024-01-01"
      reference = "CVE-2024-32970"
   strings:
      $href_xss = /href\s*=\s*["']\s*javascript\s*:/i
      $event_handler = /on\w+\s*=\s*["']\s*[^"']*["']/i
   condition:
      any of them
}

Sigma Rule

title: CVE-2024-32970 Phlex XSS Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-32970 via javascript: URLs or event handlers in HTTP requests
author: Valters IT
logsource:
   category: webserver
   product: apache
   service: access_combined
detection:
   selection:
      cs-uri-query|contains:
         - 'javascript:'
         - 'onclick='
         - 'onload='
         - 'onerror='
         - 'onmouseover='
   condition: selection
falsepositives:
   - Legitimate use of javascript: in some admin interfaces (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32970 Phlex XSS Attempt - javascript: in URI"; flow:to_server,established; content:"javascript:"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-32970 Phlex XSS Attempt - Event Handler in URI"; flow:to_server,established; pcre:"/on\w+=/i"; http_uri; classtype:web-application-attack; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Phlex: Update to the latest patched version for your minor release line (e.g., >= 2.11.0 for v2.x). Run bundle update phlex or gem update phlex.
2. Implement CSP: Add the following header to your web server configuration:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

   This prevents inline JavaScript execution, mitigating the XSS even if the vulnerability is present.

Long-term Measures:

• Conduct a code review to identify all places where user input is rendered in HTML attributes.
• Use a dedicated sanitization library (e.g., sanitize gem) for user-provided URLs and attributes.
• Enable CSP reporting to monitor for violations.
• Add automated security tests (e.g., using OWASP ZAP) to detect XSS in CI/CD pipelines.

Workaround (if unable to patch):

• Configure a Content Security Policy that does not allow unsafe-inline. This effectively prevents the exploitation of this vulnerability by blocking inline JavaScript execution.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst