CVE-2024-51320

Executive Summary

CVE-2024-51320 is a Cross-Site Scripting (XSS) vulnerability in Zucchetti Ad Hoc Infinity version 2.4. An authenticated attacker can exploit this flaw via the /servlet/gsdm_fsave_htmltmp and /servlet/gsdm_btlk_openfile components to inject malicious scripts. While the CVSS score is listed as 0.0 (likely unassigned or placeholder), the impact is severe: successful exploitation can lead to Remote Code Execution (RCE) through chained attacks, such as session hijacking or credential theft. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the lack of a patch makes this a critical risk for affected deployments.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a proprietary Java-based web application (Zucchetti Ad Hoc Infinity). No open-source package or supply chain component is directly affected.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned – likely placeholder; actual severity is high due to RCE potential)
• Attack Vector: Network (authenticated)
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must interact with malicious content)
• Scope: Changed (XSS can impact other components)
• Confidentiality/Integrity/Availability: High (via chained RCE)
• Threat Level: Critical (due to unpatched status and RCE potential)

Deep Dive & Mechanics

The vulnerability resides in two servlets: /servlet/gsdm_fsave_htmltmp and /servlet/gsdm_btlk_openfile. These endpoints handle file saving and opening operations without proper input sanitization. An authenticated attacker can inject arbitrary JavaScript or HTML into parameters processed by these servlets. When the malicious payload is rendered in a victim’s browser (e.g., via a crafted link or stored content), it executes in the context of the application’s domain.

Attack Flow:

1. Attacker authenticates to the Zucchetti Ad Hoc Infinity application.
2. Attacker crafts a malicious request to /servlet/gsdm_fsave_htmltmp with a payload in a parameter (e.g., filename or content).
3. The payload is stored on the server (persistent XSS) or reflected immediately.
4. Victim (another authenticated user) accesses the malicious content, triggering script execution.
5. The script can steal session cookies, perform actions on behalf of the victim, or download additional malware leading to RCE.

Root Cause: Lack of input validation and output encoding in the servlet handlers.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code likely resembles:

// Vulnerable (pseudo-code)
protected void doPost(HttpServletRequest req, HttpServletResponse resp) {
    String filename = req.getParameter("filename");
    // Directly writes filename to response without encoding
    resp.getWriter().write("<a href=\"/download?file=" + filename + "\">Download</a>");
}

A patched version would sanitize input:

// Patched (pseudo-code)
protected void doPost(HttpServletRequest req, HttpServletResponse resp) {
    String filename = req.getParameter("filename");
    String safeFilename = StringEscapeUtils.escapeHtml4(filename);
    resp.getWriter().write("<a href=\"/download?file=" + safeFilename + "\">Download</a>");
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to Zucchetti Ad Hoc Infinity 2.4 with valid credentials.
• A web browser or tool like Burp Suite.

Step-by-Step Exploit:

1. Log in to the application.
2. Intercept a request to /servlet/gsdm_fsave_htmltmp using Burp Suite.
3. Modify a parameter (e.g., filename) to inject a payload:

   filename=<script>alert('XSS')</script>
   

4. Send the request. The payload is stored.
5. Access the stored content (e.g., via /servlet/gsdm_btlk_openfile with the same filename). The script executes.

Proof-of-Concept (PoC) Code:

import requests

target = "https://target.com/servlet/gsdm_fsave_htmltmp"
session = requests.Session()
# Authenticate first (omitted for brevity)
payload = {"filename": "<script>alert('XSS')</script>"}
response = session.post(target, data=payload)
print("Payload stored. Access via /servlet/gsdm_btlk_openfile")

Blue Team (Defense & Detection)

Detection Steps:

• Monitor logs for unusual parameters in /servlet/gsdm_fsave_htmltmp and /servlet/gsdm_btlk_openfile requests.
• Look for <script>, onerror, onload, or other XSS patterns in POST data.
• Use WAF rules to block common XSS payloads.

Mitigation:

• Apply input validation and output encoding (e.g., OWASP Java Encoder).
• Restrict access to these servlets via network segmentation.
• Implement Content Security Policy (CSP) headers.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /servlet/gsdm_fsave_htmltmp with suspicious parameters.
  • GET requests to /servlet/gsdm_btlk_openfile with encoded JavaScript.
• File IOCs:
  • Temporary files in the application’s temp directory containing script tags.
• Behavioral IOCs:
  • Unusual outbound connections from the application server (e.g., to attacker-controlled domains).
  • Unexpected session cookie theft or account takeover.

Detection Engineering

YARA Rule

rule CVE_2024_51320_XSS {
    meta:
        description = "Detects XSS payloads in Zucchetti Ad Hoc Infinity requests"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
    condition:
        any of them
}

Sigma Rule

title: Zucchetti Ad Hoc Infinity XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS payloads in requests to /servlet/gsdm_fsave_htmltmp or /servlet/gsdm_btlk_openfile
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/servlet/gsdm_fsave_htmltmp'
            - '/servlet/gsdm_btlk_openfile'
        cs-uri-query|re:
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of script tags in file names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51320 XSS Attempt"; flow:to_server; content:"/servlet/gsdm_fsave_htmltmp"; http_uri; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-51320 XSS Attempt"; flow:to_server; content:"/servlet/gsdm_btlk_openfile"; http_uri; pcre:"/onerror\s*=\s*["']?[^"']*["']?/i"; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application from untrusted networks if possible.
2. Apply a virtual patch using a WAF to block XSS payloads in the affected servlets.
3. Restrict access to /servlet/gsdm_fsave_htmltmp and /servlet/gsdm_btlk_openfile to trusted IPs only.

Long-Term Fix:

• Contact Zucchetti for an official patch or upgrade to a non-vulnerable version.
• Implement input validation and output encoding in all servlets.
• Conduct a security audit of the application’s codebase.

Workaround:

• Disable the affected servlets if not required for business operations.

Valters IT