CVE-2024-34343

Executive Summary

CVE-2024-34343 is a medium-severity vulnerability in the Nuxt.js framework (versions prior to 3.12.4) that allows a reflected Cross-Site Scripting (XSS) attack via the navigateTo function. The vulnerability stems from a parsing discrepancy between the ufo library's parseURL and isScriptProtocol functions. An attacker can craft a URL containing the javascript: protocol with special characters (e.g., newlines or tabs) that bypasses the script protocol check, leading to XSS after Server-Side Rendering (SSR). The CVSS score is 6.3, and while the EPSS score is currently 0.0%, the public availability of PoC details warrants immediate attention.

Supply Chain & Package Security

This vulnerability affects the Nuxt.js package, which is distributed via npm. Users should verify their package.json and package-lock.json files to ensure they are not using a vulnerable version. The fix is included in version 3.12.4, and no workarounds are available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
• Base Score: 6.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) - The victim must click a crafted link.
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The threat level is medium due to the requirement for user interaction and the limited impact. However, the ease of exploitation and the potential for phishing campaigns increase the risk.

Deep Dive & Mechanics

The vulnerability lies in the navigateTo function within Nuxt.js. This function is designed to block the javascript: protocol to prevent XSS. However, it uses the ufo library for URL parsing, which has a discrepancy:

1. Initial Protocol Check: The function first checks if the URL has a protocol using ufo's hasProtocol. This correctly identifies javascript: as a protocol.
2. URL Parsing: The URL is then parsed using ufo's parseURL. This function refuses to parse poorly formatted URLs. For example, javascript:alert(1) returns null or empty strings for all components.
3. Script Protocol Check: The parsed URL's protocol is checked against a list of script protocols using isScriptProtocol. Since parseURL returned null for the protocol, this check fails, and the URL is considered safe.
4. Bypass via Whitespace: Even if a protocol is identified, parseURL does not strip whitespace. Inserting a newline or tab before the protocol (e.g., \njavascript:alert(1)) bypasses the special protocol check at the top of parseURL, allowing the javascript: protocol to pass through.

This vulnerability only triggers XSS after SSR has occurred, as the javascript: protocol in a location header does not execute in the server context.

Vulnerable vs. Patched Code

Vulnerable Code (Nuxt < 3.12.4):

// Simplified vulnerable logic
function navigateTo(url) {
  if (hasProtocol(url)) {
    const parsed = parseURL(url);
    if (isScriptProtocol(parsed.protocol)) {
      // Block script protocols
      return;
    }
  }
  // Proceed with navigation
  window.location.href = url;
}

Patched Code (Nuxt >= 3.12.4):

// Simplified patched logic
function navigateTo(url) {
  // Normalize and validate URL before parsing
  const normalizedUrl = url.trim();
  if (hasProtocol(normalizedUrl)) {
    const parsed = parseURL(normalizedUrl);
    if (isScriptProtocol(parsed.protocol) || /^javascript:/i.test(normalizedUrl)) {
      // Block script protocols
      return;
    }
  }
  // Proceed with navigation
  window.location.href = normalizedUrl;
}

The patch adds URL normalization (trimming whitespace) and an additional regex check for the javascript: protocol to catch bypasses.

Exploitation & Lab Setup

Red Team

Proof of Concept (PoC): An attacker can craft a URL that bypasses the navigateTo function's checks. For example:

http://victim.com/navigate?to=%0Ajavascript:alert(document.cookie)

The %0A is a URL-encoded newline character. When the victim clicks this link, the navigateTo function processes the URL, and the newline bypasses the protocol check, resulting in XSS.

Lab Setup:

1. Set up a vulnerable Nuxt.js application (version < 3.12.4).
2. Create a page that uses navigateTo with user input (e.g., a query parameter).
3. Host the application and send the crafted link to a victim.

Exploit Code:

<!-- Exploit HTML page -->
<a href="http://victim.com/navigate?to=%0Ajavascript:alert('XSS')">Click me</a>

Blue Team

Detection:

• Monitor for URLs containing %0A, %09, or other whitespace characters before javascript: in web logs.
• Look for unusual patterns in the navigateTo parameter.

Mitigation:

• Upgrade to Nuxt 3.12.4 or later.
• Implement Content Security Policy (CSP) headers to block inline JavaScript.
• Validate and sanitize all user inputs on the server side.

Indicators of Compromise (IOCs)

• URL Patterns: URLs containing %0Ajavascript:, %09javascript:, or similar whitespace-encoded script protocols.
• Web Logs: Requests to endpoints using navigateTo with suspicious query parameters.
• Client-Side Behavior: Unexpected JavaScript execution after navigation.

Detection Engineering

YARA Rule

rule CVE_2024_34343_Nuxt_XSS {
    meta:
        description = "Detects attempts to exploit CVE-2024-34343 in Nuxt.js"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-34343"
    strings:
        $s1 = /%0[ADad]javascript:/ nocase
        $s2 = /%09javascript:/ nocase
        $s3 = /navigateTo.*%0[ADad]/ nocase
        $s4 = /navigateTo.*%09/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-34343 Nuxt.js navigateTo XSS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2024-34343 via whitespace-encoded javascript: protocol in navigateTo parameter.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - '%0Ajavascript:'
            - '%0Djavascript:'
            - '%09javascript:'
    condition: selection
falsepositives:
    - Legitimate use of whitespace in URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-34343 Nuxt.js navigateTo XSS Attempt"; flow:to_server; content:"navigateTo"; http_uri; pcre:"/navigateTo.*%0[ADad]javascript:/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade Nuxt.js to version 3.12.4 or later.
2. Workaround: No known workarounds exist. The only fix is to upgrade.
3. Long-Term: Implement a Content Security Policy (CSP) that restricts script execution. Validate and sanitize all user inputs on the server side.
4. Monitoring: Deploy the provided detection rules to identify exploitation attempts.

Valters IT signature: This report is generated for educational and defensive purposes. Unauthorized use of this information for malicious activities is prohibited.