CVE-2024-41663

Executive Summary

CVE-2024-41663 is a self-XSS vulnerability in Canarytokens, specifically in the "Cloned Website" Canarytoken. The flaw allows a token creator to inject JavaScript into the destination URL of a slow-redirect token. When the creator later views the management page for that token, the injected script executes. While this is a self-XSS (the attacker can only attack themselves), a social engineering vector exists where an attacker creates a malicious token and sends the management link to a victim. However, no sensitive session information is disclosed to the attacker. The vulnerability is patched on Canarytokens.org, and self-hosted users must update to the latest Docker image.

Supply Chain & Package Security

This vulnerability affects the Canarytokens Docker image, which is a self-hosted deployment option. The supply chain risk is limited to the Docker image itself; no NPM, PyPI, Go, or Ruby packages are involved. Users should verify the integrity of the Docker image they pull.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a link)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (script execution in victim's browser)
• Availability Impact: None

Threat Level: Low. The vulnerability requires user interaction and does not expose sensitive data. However, it can be used for phishing or social engineering attacks.

Deep Dive & Mechanics

The vulnerability resides in the "Cloned Website" Canarytoken, which uses a slow-redirect mechanism. When a token is created, the user specifies a destination URL. This URL is not properly sanitized, allowing JavaScript injection. The injected script is stored and later executed when the token creator (or a victim who clicks the management link) views the token's management page.

Attack Flow:

1. Attacker creates a Canarytoken with a malicious destination URL containing JavaScript (e.g., javascript:alert(1) or <script>alert(1)</script>).
2. Attacker sends the management link for this token to a victim.
3. Victim clicks the link and views the management page.
4. The injected JavaScript executes in the victim's browser.

Limitations:

• The attack is self-XSS; the attacker cannot steal session cookies or other sensitive data.
• The victim must be tricked into clicking the management link.

Vulnerable vs. Patched Code

Vulnerable Code (before sha-097d91a): The destination URL is not sanitized before being stored or rendered on the management page. For example:

// Vulnerable: directly uses user input
let destinationUrl = req.body.destinationUrl;
// ... stored in database
// Later rendered without escaping
document.getElementById('token-destination').innerHTML = destinationUrl;

Patched Code (after sha-097d91a): The destination URL is sanitized using a library like DOMPurify or encoded before rendering. For example:

// Patched: sanitize input
let destinationUrl = DOMPurify.sanitize(req.body.destinationUrl);
// ... stored in database
// Rendered safely
document.getElementById('token-destination').textContent = destinationUrl;

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Canarytokens instance (self-hosted or canarytokens.org).
• Ability to create a "Cloned Website" token.

Steps:

1. Create a new "Cloned Website" Canarytoken.
2. In the destination URL field, enter a JavaScript payload, e.g.:

   javascript:alert('XSS')
   

   or

   "><script>alert('XSS')</script>
   

3. Save the token and copy the management link.
4. Send the management link to the victim via email or messaging.
5. When the victim clicks the link, the JavaScript executes.

Note: This is a self-XSS; the attacker cannot steal session data. The attack relies on social engineering.

Blue Team

Detection:

• Monitor for creation of Canarytokens with unusual destination URLs (e.g., containing javascript: or <script>).
• Alert on management page access from unexpected IPs or user agents.
• Use web application firewalls (WAF) to block malicious payloads in token creation requests.

Prevention:

• Update to the patched version (sha-097d91a or later).
• Implement input validation and output encoding for all user-supplied data.
• Educate users about phishing attacks involving management links.

Indicators of Compromise (IOCs)

• Network: HTTP requests to Canarytokens management pages with Referer headers containing malicious URLs.
• File: Log entries showing creation of tokens with javascript: or <script> in the destination URL.
• Behavior: Unusual access patterns to token management pages (e.g., from non-admin IPs).

Detection Engineering

YARA Rule

rule CVE_2024_41663_Canarytokens_Self_XSS {
    meta:
        description = "Detects Canarytokens self-XSS payloads in destination URLs"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-41663"
    strings:
        $xss1 = /javascript\s*:/ nocase
        $xss2 = /<script[^>]*>/i
        $xss3 = /on\w+\s*=/i
    condition:
        any of them
}

Sigma Rule

title: Canarytokens Self-XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of Canarytokens with malicious destination URLs
author: Valters IT
date: 2024-01-01
logsource:
    category: web
    product: canarytokens
detection:
    selection:
        event: token_created
        destination_url|contains:
            - 'javascript:'
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in URLs (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-41663 Canarytokens Self-XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/token/create"; http_uri; content:"destinationUrl"; nocase; pcre:"/(javascript\s*:|<script[^>]*>)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update self-hosted Canarytokens to the latest Docker image (sha-097d91a or later).
2. For canarytokens.org users, no action is needed; the patch is already applied.

Long-term Measures:

• Implement input validation and output encoding for all user-supplied data.
• Use Content Security Policy (CSP) headers to mitigate XSS.
• Conduct regular security audits of web applications.
• Educate users about phishing attacks involving management links.

Workarounds:

• If patching is not possible, disable the "Cloned Website" token type.
• Restrict access to token management pages to trusted IPs only.

Valters IT