CVE-2024-34321

Executive Summary

CVE-2024-34321 is a reflected cross-site scripting (XSS) vulnerability in ProPhoenix Law RMS version 2022.2403.3.101, specifically within the Notes.aspx endpoint via the PageTitle and Notes parameters. An unauthenticated remote attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the context of the victim's browser. Successful exploitation may lead to session hijacking, credential theft, or redirection to malicious sites, impacting law enforcement and public safety personnel who use this Records Management System.

Technical Analysis

ProPhoenix Law RMS (Records Management System) is a software platform used by law enforcement agencies, dispatch centers, and public safety organizations to manage incident reports, case files, and related records. Version 2022.2403.3.101 contains a reflected XSS flaw in the Notes.aspx page.

Reflected XSS occurs when an application takes user-supplied input (in this case, the PageTitle and Notes parameters) and includes it in an HTTP response without proper output encoding or sanitization. The Notes.aspx endpoint is designed to render user-provided notes or page titles. Because the input is not neutralized, an attacker can inject HTML/JavaScript that is reflected back to the victim's browser and executed immediately.

The vulnerability is client-side, meaning the attacker must convince a victim to click a crafted link. The attack surface is the web interface of Law RMS, which is typically deployed on internal networks or exposed via VPN/remote access portals for law enforcement personnel. No authentication is required to trigger the reflection if the endpoint is publicly reachable, though note that the CVSS vector assumes user interaction (UI:R). The impact is limited to confidentiality and integrity of the victim's session, but scope change (S:C) is possible if the XSS allows access to other applications on the same origin.

The root cause is a lack of input validation and output encoding for the PageTitle and Notes parameters. The Notes.aspx page likely uses server-side controls (e.g., ASP.NET labels or literal controls) that render user input directly into the HTML response without HTML-encoding. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability.

No public proof-of-concept (PoC) or exploit code is available, and the vendor has not issued a patch. The CVSS score is not provided in the NVD, but the vector is derived from the vulnerability class and standard scoring for reflected XSS.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (reflected XSS) and the specific endpoint and parameters mentioned in the NVD description.

1. Reconnaissance/Target Identification: An attacker identifies an exposed ProPhoenix Law RMS instance. This could be through Shodan searches for http.title:"Law RMS" or by scanning for the Notes.aspx endpoint on law enforcement networks. The attacker needs to locate a reachable instance, potentially via direct internet exposure or through a compromised VPN account.

2. Triggering the Flaw Class: The attacker crafts a URL that points to Notes.aspx and includes malicious JavaScript in the PageTitle or Notes parameter. For example: https://target/Notes.aspx?PageTitle=<script>alert(document.cookie)</script>&Notes=test. The exact parameter name and encoding must match the application's expectations, but no specific payload details are available from the description.

3. Payload/Execution Method: The attacker delivers the crafted URL to a victim (e.g., a law enforcement officer or dispatcher) via phishing email, social engineering, or a malicious link on a compromised site. When the victim clicks the link, the server reflects the unsanitized input in the response, and the victim's browser executes the JavaScript. The payload could steal session cookies, perform actions on behalf of the victim, or redirect to a credential harvesting page.

4. Post-Exploitation Impact: Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, theft of sensitive law enforcement data (case files, personal information), or further lateral movement if the victim has access to other internal systems. Given the sensitive nature of law enforcement data, the impact on confidentiality and integrity is high.

Impact Assessment

The vulnerability affects ProPhoenix Law RMS v2022.2403.3.101, a system used by law enforcement and public safety agencies. The blast radius includes any organization using this version with the Notes.aspx endpoint exposed to untrusted networks.

CVSS subscores from the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N:

• Attack Vector (AV:N): Network-exploitable, meaning the attacker can trigger the vulnerability remotely.
• Attack Complexity (AC:L): Low complexity; no special conditions are required beyond user interaction.
• Privileges Required (PR:N): No authentication needed to craft the malicious link, though the victim must be authenticated to the application.
• User Interaction (UI:R): The victim must click the crafted link.
• Scope (S:C): The vulnerability can affect resources beyond the vulnerable component (e.g., other applications on the same domain).
• Confidentiality (C:L): Limited impact, as the attacker can access the victim's session data but not necessarily the entire system.
• Integrity (I:L): Limited impact, as the attacker can modify content within the victim's session.
• Availability (A:N): No impact on availability.

Business impact includes potential data breach of sensitive law enforcement records, reputational damage, and regulatory penalties (e.g., CJIS compliance violations). The lack of a patch increases the risk, as organizations must rely on mitigations.

Detection Guidance

Sigma Rule

title: Reflected XSS in ProPhoenix Law RMS Notes.aspx
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects reflected XSS attempts via PageTitle or Notes parameters in Notes.aspx
author: Threat Intelligence
date: 2025-04-08
logsource:
  category: webserver
  product: iis
detection:
  selection:
    cs-method: 'GET'
    cs-uri-stem|endswith: '/Notes.aspx'
    cs-uri-query|contains:
      - 'PageTitle='
      - 'Notes='
  keywords:
    - '<script'
    - 'javascript:'
    - 'onerror='
    - 'onload='
  condition: selection and keywords
falsepositives:
  - Legitimate use of HTML in notes by administrators
level: high

YARA Rule

rule CVE_2024_34321_Reflected_XSS
{
    meta:
        description = "Detects reflected XSS payloads in ProPhoenix Law RMS Notes.aspx"
        author = "Threat Intelligence"
        date = "2025-04-08"
        reference = "CVE-2024-34321"
    strings:
        $xss1 = "PageTitle=" ascii nocase
        $xss2 = "Notes=" ascii nocase
        $script1 = "<script>" ascii nocase
        $script2 = "javascript:" ascii nocase
        $script3 = "onerror=" ascii nocase
    condition:
        any of ($xss*) and any of ($script*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2024-34321 ProPhoenix Law RMS Reflected XSS Attempt"; flow:to_server,established; http.uri; content:"/Notes.aspx"; http.uri; content:"PageTitle="; nocase; http.uri; content:"<script"; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-34321 ProPhoenix Law RMS Reflected XSS Attempt (Notes)"; flow:to_server,established; http.uri; content:"/Notes.aspx"; http.uri; content:"Notes="; nocase; http.uri; content:"javascript:"; nocase; sid:1000002; rev:1;)

Elastic Detection

sequence by host.id with maxspan=5s
[ network where network.protocol == "http" and url.path == "/Notes.aspx" and url.query : ("*PageTitle*" or "*Notes*") and url.query : ("*<script*" or "*javascript:*" or "*onerror=*") ]

Splunk SPL Query

index=web sourcetype=iis
| search uri_path="/Notes.aspx" (uri_query="*PageTitle=*" OR uri_query="*Notes=*")
| regex uri_query="(?i)(<script|javascript:|onerror=|onload=)"
| stats count by src_ip, uri_query, user_agent
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100001" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>/Notes.aspx</url>
    <regex url="PageTitle=.*(&lt;script|javascript:|onerror=)">\.</regex>
    <description>CVE-2024-34321: ProPhoenix Law RMS Reflected XSS attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100002" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>/Notes.aspx</url>
    <regex url="Notes=.*(&lt;script|javascript:|onerror=)">\.</regex>
    <description>CVE-2024-34321: ProPhoenix Law RMS Reflected XSS attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Deploy a Web Application Firewall (WAF) with rules to block XSS payloads targeting the PageTitle and Notes parameters.
   • Restrict access to Notes.aspx to trusted internal networks only; avoid exposing Law RMS directly to the internet.
   • Enforce strict Content Security Policy (CSP) headers to mitigate script execution.
   • Educate users about phishing links and the risks of clicking untrusted URLs.

2. Patch/Upgrade Steps:

   • No vendor patch is available. Monitor ProPhoenix security advisories for updates.
   • If a patched version becomes available, upgrade immediately. Until then, consider compensating controls such as input validation at the reverse proxy level.

3. Long-Term Hardening:

   • Implement secure coding practices: output encoding for all user-supplied data, input validation, and use of anti-XSS libraries.
   • Conduct regular security assessments and penetration testing of Law RMS deployments.
   • Apply the principle of least privilege for service accounts and enforce multi-factor authentication for all users.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-34321
• ProPhoenix Official Website: https://www.prophoenix.com (check for security advisories)
• OWASP XSS Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
• MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/
• CWE-79: https://cwe.mitre.org/data/definitions/79.html

No known threat actor campaigns or exploit-in-the-wild evidence for this specific CVE at this time.