CVE-2024-52286

Improper Input Validation (CWE-20)

Published: Nov 11, 2024 / Updated: 8d ago

010
CVSS 2EPSS 0.04%Low
CVE info copied to clipboard

Summary

Stirling-PDF, a locally hosted web application for PDF operations, has a vulnerability in its Merge functionality. The issue is in the file 'src/main/resources/static/js/merge.js' starting at Line 24, where user-supplied file names are directly input into innerHTML without sanitization. This allows malicious users to upload files with names containing HTML tags, potentially including JavaScript code, which can then be executed in the context of the user.

Impact

This vulnerability enables a self-injection style attack where a user could be tricked into uploading a maliciously named file, leading to the execution of arbitrary JavaScript code in their browser. While the impact is limited to the user who uploads the file and doesn't affect other users directly, it breaks the expected security restrictions of the application. The potential impacts include: 1. Phishing attacks: Users could be social engineered into running malicious code, potentially leading to credential theft or further system compromise. 2. Data exfiltration: Executed JavaScript could access and transmit sensitive information from the user's session. 3. Client-side malware execution: The injected code could potentially download and execute additional malware on the user's system. 4. Session hijacking: An attacker could potentially steal or manipulate the user's session data.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. The vulnerability has been addressed in version 0.32.0 of Stirling-PDF. All users are advised to upgrade to this version or later to mitigate the risk.

Mitigation

The following mitigation steps are recommended: 1. Upgrade immediately: Update Stirling-PDF to version 0.32.0 or later, which addresses this vulnerability. 2. Input Validation: Implement strict input validation for file names, rejecting or sanitizing any input containing HTML or JavaScript code. 3. Content Security Policy: Implement a strong Content Security Policy to prevent the execution of inline scripts. 4. User Education: Inform users about the risks of uploading files from untrusted sources and the importance of verifying file names. 5. Regular Security Audits: Conduct regular code reviews and security audits to identify similar vulnerabilities in other parts of the application. There are no known workarounds for this vulnerability other than upgrading to the patched version.

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Timeline

CVE Assignment

NVD published the first details for CVE-2024-52286

Nov 11, 2024 at 8:15 PM
CVSS

A CVSS base score of 2 has been assigned.

Nov 11, 2024 at 8:20 PM / nvd
First Article

Feedly found the first article mentioning CVE-2024-52286. See article

Nov 11, 2024 at 8:24 PM / National Vulnerability Database
Threat Intelligence Report

CVE-2024-52286 is a critical vulnerability in Stirling-PDF that allows unauthenticated users to execute JavaScript code through the Merge functionality by uploading files with malicious HTML tags in their names, impacting only the user who uploads the file. This self-injection attack has been addressed in version 0.32.0, and users are strongly advised to upgrade, as there are no known workarounds. There is no indication of exploitation in the wild or proof-of-concept exploits mentioned in the article. See article

Nov 11, 2024 at 8:24 PM
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Nov 11, 2024 at 8:24 PM
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Nov 11, 2024 at 8:25 PM
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Nov 11, 2024 at 11:46 PM
EPSS

EPSS Score was set to: 0.04% (Percentile: 10.1%)

Nov 12, 2024 at 9:54 AM
Static CVE Timeline Graph

Affected Systems

Stirlingpdf/stirling_pdf
+null more

Links to Mitre Att&cks

T1562.003: Impair Command History Logging
+null more

Attack Patterns

CAPEC-10: Buffer Overflow via Environment Variables
+null more

References

CVE-2024-52286
In affected versions the Merge functionality takes untrusted user input (file name) and uses it directly in the creation of HTML pages allowing any unauthenticated to execute JavaScript code in the context of the user. The file name is directly being input into InnerHTML with no sanitization on the file name, allowing a malicious user to be able to upload files with names containing HTML tags.
CVE-2024-52286
In affected versions the Merge functionality takes untrusted user input (file name) and uses it directly in the creation of HTML pages allowing any unauthenticated to execute JavaScript code in the context of the user. The file name is directly being input into InnerHTML with no sanitization on the file name, allowing a malicious user to be able to upload files with names containing HTML tags.
CVE-2024-52286
Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In affected versions the Merge functionality takes untrusted user input (file name) and uses it directly in the creation of HTML pages allowing any unauthenticated to execute JavaScript code in the context of the user. The issue stems to the code starting at `Line 24` in `src/main/resources/static/js/merge.js`. The file name is directly being input into InnerHTML with no sanitization on the file name, allowing a malicious user to be able to upload files with names containing HTML tags. As HTML tags can include JavaScript code, this can be used to execute JavaScript code in the context of the user. This is a self-injection style attack and relies on a user uploading the malicious file themselves and it impact only them, not other users. A user might be social engineered into running this to launch a phishing attack. Nevertheless, this breaks the expected security restrictions in place by the application. This issue has been addressed in version 0.32.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
See 3 more references

News

CVE-2024-52286
In affected versions the Merge functionality takes untrusted user input (file name) and uses it directly in the creation of HTML pages allowing any unauthenticated to execute JavaScript code in the context of the user. The file name is directly being input into InnerHTML with no sanitization on the file name, allowing a malicious user to be able to upload files with names containing HTML tags.
NA - CVE-2024-52286 - Stirling-PDF is a locally hosted web...
Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In affected versions the Merge functionality takes untrusted user input (file name) and...
CVE-2024-52286
In affected versions the Merge functionality takes untrusted user input (file name) and uses it directly in the creation of HTML pages allowing any unauthenticated to execute JavaScript code in the context of the user. The file name is directly being input into InnerHTML with no sanitization on the file name, allowing a malicious user to be able to upload files with names containing HTML tags.
CVE-2024-52286 - Stirling-PDF HTML Injection Vulnerability
In affected versions the Merge functionality takes untrusted user input (file name) and uses it directly in the creation of HTML pages allowing any unauthenticated to execute JavaScript code in the context of the user. The file name is directly being input into InnerHTML with no sanitization on the file name, allowing a malicious user to be able to upload files with names containing HTML tags.
CVE-2024-52286
In affected versions the Merge functionality takes untrusted user input (file name) and uses it directly in the creation of HTML pages allowing any unauthenticated to execute JavaScript code in the context of the user. The file name is directly being input into InnerHTML with no sanitization on the file name, allowing a malicious user to be able to upload files with names containing HTML tags.
See 6 more articles and social media posts

CVSS V3.1

Unknown

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI