CVE-2024-12092
📋 TL;DR
A stored Cross-site Scripting (XSS) vulnerability in ENOVIA Collaborative Industry Innovator on 3DEXPERIENCE R2024x allows attackers to inject malicious scripts that execute in users' browsers. This affects organizations using the vulnerable ENOVIA platform version, potentially compromising user sessions and data.
💻 Affected Systems
- ENOVIA Collaborative Industry Innovator
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on client systems.
Likely Case
Session hijacking leading to unauthorized access, data theft, or manipulation of application content visible to other users.
If Mitigated
Limited impact if input validation and output encoding are properly implemented, though stored XSS remains dangerous.
🎯 Exploit Status
Stored XSS typically requires some level of access to inject malicious content, but execution is automatic when users view the compromised content.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patch version
Vendor Advisory: https://www.3ds.com/vulnerability/advisories
Restart Required: Yes
Instructions:
1. Review the Dassault Systèmes advisory. 2. Apply the recommended patch/update. 3. Restart the ENOVIA application/services. 4. Test functionality.
🔧 Temporary Workarounds
Implement Content Security Policy (CSP)
allAdd CSP headers to restrict script execution sources
Add 'Content-Security-Policy' header with appropriate directives in web server configuration
Input Validation and Output Encoding
allSanitize user input and encode output in the application
Implement proper input validation and output encoding in affected components
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to detect and block XSS payloads
- Restrict user permissions to minimize injection points and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Test input fields for XSS by injecting script payloads and checking if they execute when viewedCheck Version:
Check ENOVIA/3DEXPERIENCE version through admin interface or configuration filesVerify Fix Applied:
Verify patch installation via version check and retest XSS payloads to confirm they are properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual input patterns containing script tags or JavaScript in user-submitted content
- Multiple failed login attempts following suspicious content submission
Network Indicators:
- HTTP requests containing common XSS payload patterns
- Unexpected outbound connections from client browsers
SIEM Query:
source="web_logs" AND (message="<script>" OR message="javascript:" OR message="onerror=" OR message="onload=")