CVE-2024-52809

Executive Summary

CVE-2024-52809 is a Cross-site Scripting (XSS) vulnerability in the vue-i18n internationalization plugin for Vue.js. The flaw occurs when locale message ASTs are generated in development mode, allowing an attacker to inject malicious scripts via crafted locale messages passed to createI18n or useI18n. This vulnerability affects versions prior to 9.14.2 and 10.0.5. No known workarounds exist, and the only remediation is upgrading to the patched versions. The EPSS score is 0.0%, indicating low exploitation activity at the time of analysis.

Supply Chain & Package Security

This vulnerability affects the vue-i18n npm package, a widely used internationalization library in the Vue.js ecosystem. As an open-source dependency, it can be introduced into applications via package.json or npm install. Developers should verify their lock files and dependency trees to ensure they are not using an affected version. Supply chain attacks could exploit this by injecting malicious locale messages through compromised upstream packages or direct dependency manipulation.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, but based on the vulnerability type (XSS) and attack vector (network, low complexity, no privileges required, user interaction required), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R) – victim must visit a page with malicious locale messages
• Scope (S): Changed (C) – XSS can impact the user's browser session
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score: 5.4 (Medium)

Threat Level: Medium. Exploitation requires user interaction and development mode, but the impact includes session hijacking, data theft, and defacement.

Deep Dive & Mechanics

The vulnerability resides in the AST generation logic for locale messages in development mode. When vue-i18n processes locale messages (e.g., via createI18n({ messages: { en: { hello: "Hello {name}" } } })), it parses them into an AST for efficient rendering. In development mode, the AST generation does not properly sanitize user-controlled input within the message strings. An attacker can craft a locale message containing malicious JavaScript, such as <img src=x onerror=alert(1)>, which is then rendered unsanitized in the browser, leading to XSS.

The vulnerable code path is in the compile or parse functions used during development. The patch in versions 9.14.2 and 10.0.5 introduces proper escaping of HTML entities in the AST output, preventing script injection.

Vulnerable vs. Patched Code

Vulnerable Code (simplified example):

// vue-i18n < 9.14.2, < 10.0.5
function compileMessage(message) {
  // AST generation without sanitization
  return { type: 'text', value: message };
}

Patched Code (simplified example):

// vue-i18n >= 9.14.2, >= 10.0.5
function compileMessage(message) {
  // AST generation with HTML entity escaping
  const escaped = message.replace(/</g, '&lt;').replace(/>/g, '&gt;');
  return { type: 'text', value: escaped };
}

The patch ensures that any HTML-like content in locale messages is escaped, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Vue.js application using vue-i18n version < 9.14.2 or < 10.0.5.
• The application must be running in development mode (e.g., NODE_ENV=development).
• The attacker must be able to inject a malicious locale message (e.g., via a compromised API, user input, or direct configuration).

Exploitation Steps:

1. Identify a Vue.js application using an affected version of vue-i18n.
2. Craft a malicious locale message containing an XSS payload, e.g.:

   const messages = {
     en: {
       greeting: '<img src=x onerror=alert(document.cookie)>'
     }
   };
   

3. Inject this message into the application's createI18n or useI18n configuration (e.g., via a compromised API endpoint that returns locale data).
4. When a user visits a page that renders the greeting message, the XSS payload executes in their browser.

Proof of Concept (PoC) Code:

// Exploit PoC for CVE-2024-52809
const { createI18n } = require('vue-i18n');

const i18n = createI18n({
  locale: 'en',
  messages: {
    en: {
      greeting: '<img src=x onerror=alert("XSS")>'
    }
  }
});

// In Vue component:
// <p>{{ $t('greeting') }}</p>

Blue Team

Detection:

• Monitor for unexpected locale message content in application logs or network traffic.
• Use Content Security Policy (CSP) headers to mitigate XSS impact.
• Review dependency versions in package.json and package-lock.json.

Mitigation:

• Upgrade to vue-i18n 9.14.2 or 10.0.5 immediately.
• If upgrade is not possible, ensure the application runs in production mode (NODE_ENV=production), which disables the vulnerable AST generation.
• Implement input validation for any user-supplied locale messages.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing locale message payloads with HTML/JavaScript (e.g., <script>, <img onerror=...>).
• File: Modified node_modules/vue-i18n files with version < 9.14.2 or < 10.0.5.
• Behavior: Unexpected JavaScript execution in the browser when rendering localized strings.
• Logs: Application logs showing [vue-i18n] warnings or errors related to message compilation.

Detection Engineering

YARA Rule

rule CVE_2024_52809_vue_i18n_XSS {
  meta:
    description = "Detects vulnerable vue-i18n versions with XSS in locale messages"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2024-52809"
  strings:
    $vuln_version1 = "9.14.1" ascii wide nocase
    $vuln_version2 = "10.0.4" ascii wide nocase
    $vuln_version3 = "9.14.0" ascii wide nocase
    $vuln_version4 = "10.0.3" ascii wide nocase
    $vuln_version5 = "10.0.2" ascii wide nocase
    $vuln_version6 = "10.0.1" ascii wide nocase
    $vuln_version7 = "10.0.0" ascii wide nocase
    $vuln_version8 = "9.13.0" ascii wide nocase
    $vuln_version9 = "9.12.0" ascii wide nocase
    $vuln_version10 = "9.11.0" ascii wide nocase
    $vuln_version11 = "9.10.0" ascii wide nocase
    $vuln_version12 = "9.9.0" ascii wide nocase
    $vuln_version13 = "9.8.0" ascii wide nocase
    $vuln_version14 = "9.7.0" ascii wide nocase
    $vuln_version15 = "9.6.0" ascii wide nocase
    $vuln_version16 = "9.5.0" ascii wide nocase
    $vuln_version17 = "9.4.0" ascii wide nocase
    $vuln_version18 = "9.3.0" ascii wide nocase
    $vuln_version19 = "9.2.0" ascii wide nocase
    $vuln_version20 = "9.1.0" ascii wide nocase
    $vuln_version21 = "9.0.0" ascii wide nocase
    $vuln_version22 = "8.28.0" ascii wide nocase
    $vuln_version23 = "8.27.0" ascii wide nocase
    $vuln_version24 = "8.26.0" ascii wide nocase
    $vuln_version25 = "8.25.0" ascii wide nocase
    $vuln_version26 = "8.24.0" ascii wide nocase
    $vuln_version27 = "8.23.0" ascii wide nocase
    $vuln_version28 = "8.22.0" ascii wide nocase
    $vuln_version29 = "8.21.0" ascii wide nocase
    $vuln_version30 = "8.20.0" ascii wide nocase
    $vuln_version31 = "8.19.0" ascii wide nocase
    $vuln_version32 = "8.18.0" ascii wide nocase
    $vuln_version33 = "8.17.0" ascii wide nocase
    $vuln_version34 = "8.16.0" ascii wide nocase
    $vuln_version35 = "8.15.0" ascii wide nocase
    $vuln_version36 = "8.14.0" ascii wide nocase
    $vuln_version37 = "8.13.0" ascii wide nocase
    $vuln_version38 = "8.12.0" ascii wide nocase
    $vuln_version39 = "8.11.0" ascii wide nocase
    $vuln_version40 = "8.10.0" ascii wide nocase
    $vuln_version41 = "8.9.0" ascii wide nocase
    $vuln_version42 = "8.8.0" ascii wide nocase
    $vuln_version43 = "8.7.0" ascii wide nocase
    $vuln_version44 = "8.6.0" ascii wide nocase
    $vuln_version45 = "8.5.0" ascii wide nocase
    $vuln_version46 = "8.4.0" ascii wide nocase
    $vuln_version47 = "8.3.0" ascii wide nocase
    $vuln_version48 = "8.2.0" ascii wide nocase
    $vuln_version49 = "8.1.0" ascii wide nocase
    $vuln_version50 = "8.0.0" ascii wide nocase
    $vuln_version51 = "7.8.0" ascii wide nocase
    $vuln_version52 = "7.7.0" ascii wide nocase
    $vuln_version53 = "7.6.0" ascii wide nocase
    $vuln_version54 = "7.5.0" ascii wide nocase
    $vuln_version55 = "7.4.0" ascii wide nocase
    $vuln_version56 = "7.3.0" ascii wide nocase
    $vuln_version57 = "7.2.0" ascii wide nocase
    $vuln_version58 = "7.1.0" ascii wide nocase
    $vuln_version59 = "7.0.0" ascii wide nocase
    $vuln_version60 = "6.0.0" ascii wide nocase
    $vuln_version61 = "5.0.0" ascii wide nocase
    $vuln_version62 = "4.0.0" ascii wide nocase
    $vuln_version63 = "3.0.0" ascii wide nocase
    $vuln_version64 = "2.0.0" ascii wide nocase
    $vuln_version65 = "1.0.0" ascii wide nocase
    $xss_payload = /<[^>]+onerror\s*=|javascript:/ ascii wide nocase
  condition:
    any of ($vuln_version*) and $xss_payload
}

Sigma Rule

title: CVE-2024-52809 - vue-i18n XSS via Locale Messages
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation of CVE-2024-52809 by monitoring for malicious locale message content in HTTP requests or application logs.
author: Valters IT
date: 2025-04-10
logsource:
  category: application
  product: vue-i18n
detection:
  selection:
    - message: "*<img*onerror=*"
    - message: "*<script>*"
    - message: "*javascript:*"
  condition: selection
falsepositives:
  - Legitimate use of HTML in locale messages (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-52809 - vue-i18n XSS via Locale Messages"; flow:to_server,established; content:"vue-i18n"; nocase; pcre:"/(<[^>]+onerror=|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade vue-i18n to version 9.14.2 or 10.0.5 (or later) in all projects.
2. Run npm audit or yarn audit to identify affected dependencies.
3. If upgrade is not possible, set NODE_ENV=production to disable the vulnerable development mode.

Long-term Measures:

• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Regularly update dependencies and monitor for security advisories.
• Use static analysis tools to detect potential XSS in locale messages.

Patch Details:

• Fixed versions: 9.14.2, 10.0.5
• Patch commit: Not publicly available, but upgrade is the recommended action.

Valters IT