CVE-2024-10716
📋 TL;DR
This Cross-Site Scripting (XSS) vulnerability in Pega Platform's search functionality allows attackers to inject malicious scripts into web pages viewed by other users. Affected versions include Pega Platform 8.1 through Infinity 24.2.0, potentially impacting all organizations using these versions.
💻 Affected Systems
- Pega Platform
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or deface the application interface.
Likely Case
Session hijacking leading to unauthorized access to sensitive data or functionality within the Pega application.
If Mitigated
Limited impact with proper input validation, output encoding, and Content Security Policy (CSP) headers in place.
🎯 Exploit Status
XSS vulnerabilities typically have low exploitation complexity once the injection point is identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Infinity 24.2.1 and later
Vendor Advisory: https://support.pega.com/support-doc/pega-security-advisory-e24-vulnerability-remediation-note
Restart Required: Yes
Instructions:
1. Upgrade to Pega Platform Infinity 24.2.1 or later. 2. Apply the patch following Pega's deployment procedures. 3. Restart the application server.
🔧 Temporary Workarounds
Implement Content Security Policy
allAdd CSP headers to restrict script execution sources
Add 'Content-Security-Policy' header with appropriate directives
Input Validation Filter
allImplement server-side input validation for search parameters
Configure input validation rules in Pega Platform
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block XSS payloads
- Disable search functionality if not critical to business operations
🔍 How to Verify
Check if Vulnerable:
Check Pega Platform version in System Management Application (SMA) or via PRPC:Engine version propertyCheck Version:
Check PRPC:Engine.pzInsKey or System Management ApplicationVerify Fix Applied:
Verify version is 24.2.1 or later and test search functionality with XSS payloads📡 Detection & Monitoring
Log Indicators:
- Unusual search queries containing script tags or JavaScript code
- Multiple failed search attempts with suspicious patterns
Network Indicators:
- HTTP requests with search parameters containing script tags or JavaScript
SIEM Query:
source="pega_logs" AND (search_parameter CONTAINS "<script>" OR search_parameter CONTAINS "javascript:")