CVE-2024-34326

Executive Summary

CVE-2024-34326 is a reflected cross-site scripting (XSS) vulnerability in ProPhoenix Law RMS version 2022.2403.3.101, exposed through the errorHandler.aspx endpoint via the PageTitle, Alert, and MsgType parameters. Any deployment of this Records Management System reachable over a network is potentially affected, and exploitation requires a victim to click a crafted link. Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's authenticated session, enabling session hijacking, credential theft, and actions performed on behalf of the victim.

Technical Analysis

The vulnerability is a classic reflected cross-site scripting flaw (CWE-79) located in the errorHandler.aspx handler of ProPhoenix Law RMS. According to the available description, user-supplied input passed through the PageTitle, Alert, and MsgType parameters is echoed back into the server's response without adequate output encoding, allowing an attacker to inject arbitrary script content that executes in the victim's browser.

Reflected XSS differs from stored XSS in that the malicious payload is not persisted on the server; instead, it is delivered as part of a crafted request (typically a URL) and reflected immediately into the response page. The three identified parameters act as injection points into an error-handling page, which is a common design pattern where query-string values are used to construct the page title, an alert message, or a message type indicator. Because the values are rendered directly into the HTML response, markup such as script tags, event handlers, or javascript: URIs can break out of the intended context and execute.

The attack surface is any instance of Law RMS v2022.2403.3.101 where the errorHandler.aspx endpoint is reachable by an attacker — whether directly from the internet, from a neighboring network segment, or via a link delivered to a user. The endpoint name and parameter names are drawn verbatim from the NVD description; no further implementation details (such as specific function names or server-side code paths) are available and none should be inferred. Note that because the flaw is reflected, the attacker does not need authenticated access to the application to host the malicious link, only to persuade a victim to visit it.

CVSS v3.1 scoring is not provided by the source data (NVD lists no score). The vector presented in METADATA is a representative vector for a reflected XSS arising from a network-reachable endpoint requiring user interaction, with scope change and low confidentiality/integrity impact; it should be treated as indicative until an authoritative score is published. EPSS has not yet scored this CVE, and no CWE assignment was provided in the source data (CWE-79 is assigned here as the vulnerability class).

Exploitation Scenarios

The following chain is based strictly on the vulnerability class and the single NVD-derived description; no public PoC or exploit code exists, so the steps below are generic to reflected XSS and do not assume undocumented implementation details.

1. Reconnaissance / target identification. An attacker identifies internet-exposed or internally reachable ProPhoenix Law RMS instances, for example by searching for the errorHandler.aspx endpoint and the associated product banner. Because the endpoint is a general error handler, it may be reachable without authentication and may be discovered through crawling, directory probing, or search-engine indexing of the host.

2. Triggering the flaw class. The attacker constructs a URL that reaches errorHandler.aspx with a crafted value in one of the three documented parameters — PageTitle, Alert, or MsgType. The injected value is designed to break out of the HTML context into which the server reflects it and to introduce script-bearing markup or an event handler.

3. Payload delivery / execution. The crafted link is delivered to a target user (for example, a clerk, case worker, or administrator of the Law RMS instance) via phishing email, chat, or a redirect from a controlled site. When the victim loads the link, the browser executes the injected script in the origin of the Law RMS application. There is no evidence of server-side code execution; the payload runs client-side only.

4. Post-exploitation impact. Because the script executes in the application's origin and inside any authenticated session the victim holds, an attacker can read and transmit session cookies or tokens that are not protected by HttpOnly, capture keystrokes or form data, redirect the victim to a convincing phishing page, or perform state-changing requests on behalf of the victim against the Law RMS application. The practical severity depends on the victim's role and the sensitivity of the records management data being handled as a result of the compromise. Law enforcement records management systems frequently contain personally identifiable information, investigative notes, and case data, so session compromise can translate into a significant data exposure.

No public proof-of-concept, CISA KEV entry, or confirmed in-the-wild exploitation has been reported for this CVE at the time of writing. The attack chain is therefore described at the vulnerability-class level.

Impact Assessment

The impact of CVE-2024-34326 is confined to the client side of the Law RMS application: reflected XSS does not by itself give the attacker direct access to the database or the underlying server. However, the consequences can be severe because the compromised origin is a records management system. Key impact considerations:

• Confidentiality (Low, per representative vector): Script running in the victim's session can read page content and session material, potentially exposing case records accessible to that user.
• Integrity (Low): The attacker can submit requests as the victim, potentially altering records the victim is authorized to modify.
• Availability (None): The flaw itself does not degrade availability.
• Scope (Changed): The vulnerable component is the browser session rather than the server, which broadens the affected security authority.
• User interaction (Required): The victim must follow the crafted link; the attack cannot succeed silently.

Blast radius depends on deployment exposure. Law RMS instances exposed to the internet or to large internal networks, and users with elevated privileges, represent the highest-risk targets. Because reflected XSS is session-oriented, the attacker's reach is effectively the union of all privileges held by victims who are successfully lured. There is no evidence that an unauthenticated attacker can compromise backend data without a victim's interaction.

Detection Guidance

Sigma Rule

title: Potential Reflected XSS Attempt Against ProPhoenix Law RMS errorHandler.aspx
id: 3f0a5c2e-9b71-4d6e-8c2a-1e6d4f9b7a10
status: experimental
description: Detects requests to errorHandler.aspx containing script-like payloads in the PageTitle, Alert, or MsgType parameters.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-34326
author: valtersit.com
date: 2024/05/10
logsource:
  category: webserver
  product: windows
detection:
  selection_endpoint:
    cs-uri-stem|endswith: '/errorHandler.aspx'
  selection_params:
    cs-uri-query|contains:
      - 'PageTitle='
      - 'Alert='
      - 'MsgType='
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '%3Cscript'
      - '%3Csvg'
  condition: selection_endpoint and selection_params and selection_payload
falsepositives:
  - Legitimate error-page redirects that include encoded angle brackets in message text.
level: high
tags:
  - attack.t1190
  - cwe.79

YARA Rule

rule CVE_2024_34326_LawRMS_XSS_Request
{
    meta:
        description = "Detects HTTP requests attempting reflected XSS against ProPhoenix Law RMS errorHandler.aspx via PageTitle, Alert, or MsgType parameters (CVE-2024-34326)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-34326"
        date = "2024-05-10"
        severity = "high"

    strings:
        $ep  = "errorHandler.aspx" ascii nocase
        $p1  = "PageTitle=" ascii nocase
        $p2  = "Alert=" ascii nocase
        $p3  = "MsgType=" ascii nocase
        $x1  = "<script" ascii nocase
        $x2  = "</script>" ascii nocase
        $x3  = "<svg" ascii nocase
        $x4  = "javascript:" ascii nocase
        $x5  = "onerror=" ascii nocase
        $x6  = "%3Cscript" ascii nocase

    condition:
        $ep and 1 of ($p*) and 1 of ($x*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2024-34326 ProPhoenix Law RMS errorHandler.aspx Reflected XSS Attempt"; flow:established,to_server; http.uri; content:"errorHandler.aspx"; nocase; http.uri; content:"PageTitle="; nocase; http.uri; content:"<script"; nocase; http.uri; content:"Alert="; nocase; http.uri; content:"<svg"; nocase; http.uri; content:"javascript:"; nocase; http.uri; content:"onerror="; nocase; http.uri; content:"MsgType="; nocase; http.uri; content:"%3Cscript"; nocase; classtype:web-application-attack; reference:cve,2024-34326; sid:9003432601; rev:1; metadata:created_at 2024_05_10, updated_at 2024_05_10;)

alert http any any -> any any (msg:"CVE-2024-34326 ProPhoenix Law RMS errorHandler.aspx Reflected XSS Attempt (Encoded)"; flow:established,to_server; http.uri; content:"errorHandler.aspx"; nocase; http.uri; content:"%3Cscript"; nocase; http.uri; content:"javascript%3A"; nocase; classtype:web-application-attack; reference:cve,2024-34326; sid:9003432602; rev:1; metadata:created_at 2024_05_10, updated_at 2024_05_10;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where process.name : ("w3wp.exe","httpd","nginx") and
      url.path : "*/errorHandler.aspx" and
      url.query : ("*PageTitle=*","*Alert=*","*MsgType=*") ]
  [ network where process.name : ("w3wp.exe","httpd","nginx") and
      url.path : "*/errorHandler.aspx" and
      url.query : ("*<script*","*javascript:*","*onerror=*","*%3Cscript*") ]

Splunk SPL Query

index=web sourcetype=iis OR sourcetype=access_combined cs_uri_stem="*errorHandler.aspx*"
| eval q=lower(coalesce(cs_uri_query, uri_query, ""))
| where match(q,"pagetitle=|alert=|msgtype=") AND match(q,"%3cscript|javascript:|onerror=|onload=|%3csvg|<script")
| stats count min(_time) as first_seen max(_time) as last_seen values(cs_uri_query) as payloads by src_ip c_ip clientip cs_uri_stem
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2024-34326,">
  <rule id="100343" level="10">
    <if_sid>31100</if_sid>
    <url>errorHandler.aspx</url>
    <regex type="pcre2">(?i)(PageTitle|Alert|MsgType)=.*(%3Cscript|&lt;script|javascript:|onerror=|onload=|%3Csvg)</regex>
    <description>CVE-2024-34326: Possible reflected XSS attempt against ProPhoenix Law RMS errorHandler.aspx</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2024_34326,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list is available, so the following are standard risk-reduction measures for a reflected XSS issue and should be validated against the environment.

1. Immediate mitigations.

   • Restrict network exposure: place any ProPhoenix Law RMS instance behind VPN or an allowlisted reverse proxy so the errorHandler.aspx endpoint is not reachable from untrusted networks.
   • Deploy a web application firewall (WAF) in front of the application and enable rules that reject requests to errorHandler.aspx containing script tags, <svg, javascript:, or event-handler strings in the PageTitle, Alert, and MsgType parameters.
   • If the application source is available to the operator, apply output encoding to the reflected parameter values and/or validate them against an allowlist (for example, MsgType should generally be a fixed enumeration).
   • Protect sessions: ensure cookies are set with HttpOnly and Secure, and enable a strict Content-Security-Policy (default-src 'self'; no unsafe-inline), which mitigates many reflected XSS payloads even when the underlying flaw remains.
   • Advance user awareness: brief Law RMS users to not open unsolicited links or attachments that purport to come from the application.

2. Patch/upgrade steps. Contact ProPhoenix directly to confirm whether a fixed release exists and to obtain a supported build. Because no patch evidence exists from tracked sources, do not assume a newer version resolves the flaw; require release notes or confirmation from the vendor before relying on an upgrade as a fix. Until a verified patch is available, maintain the compensating controls above.

3. Long-term hardening. Enforce output encoding and input validation as a coding standard; adopt a content security policy; schedule regular authenticated and unauthenticated web application scanning; and inventory records-management-facing applications for exposure while monitoring for behavioral anomalies in session usage.

References

• NVD entry for CVE-2024-34326: https://nvd.nist.gov/vuln/detail/CVE-2024-34326
• CWE-79, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1190, Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• ProPhoenix Law RMS product page (verify current version and security advisories): https://www.prophoenix.com/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2024-34326 is not listed at the time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or in-the-wild exploitation have been attributed to this vulnerability in the provided intelligence; public PoC, Nuclei template, and exploit code are all reported as unavailable.