CVE-2024-27728
📋 TL;DR
This Cross-Site Scripting (XSS) vulnerability in Friendica's babel debug feature allows remote attackers to inject malicious scripts via the text parameter. When exploited, this can lead to session hijacking, credential theft, or unauthorized actions on behalf of users. All Friendica instances running version 2023.12 are affected.
💻 Affected Systems
- Friendica
📦 What is this software?
Friendica by Friendica
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, take over administrative accounts, compromise the entire Friendica instance, and potentially pivot to other systems.
Likely Case
Attackers steal user session cookies and authentication tokens, enabling account takeover and unauthorized posting/actions on affected user accounts.
If Mitigated
With proper input validation and output encoding, the risk is limited to minor data leakage or functionality disruption.
🎯 Exploit Status
The vulnerability is in a debug feature that may not be enabled in production, but exploitation is straightforward when accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.03 or later
Vendor Advisory: https://github.com/friendica/friendica/pull/13927
Restart Required: No
Instructions:
1. Update Friendica to version 2024.03 or later. 2. Apply the patch from GitHub PR #13927 if updating is not possible. 3. Verify the fix by testing the babel debug feature.
🔧 Temporary Workarounds
Disable babel debug feature
allDisable or restrict access to the babel debug functionality in Friendica configuration.
Edit config/local.config.php and set 'system' => ['babel_debug' => false]
Implement WAF rules
allAdd web application firewall rules to block XSS payloads targeting the text parameter.
🧯 If You Can't Patch
- Disable the babel debug feature immediately via configuration changes.
- Implement strict Content Security Policy (CSP) headers to mitigate XSS impact.
🔍 How to Verify
Check if Vulnerable:
Check if Friendica version is 2023.12 and the babel debug feature is accessible/enabled.Check Version:
Check the VERSION file in Friendica installation directory or admin panel.Verify Fix Applied:
Test the babel debug feature with XSS payloads; successful payload execution indicates vulnerability.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to babel debug endpoints
- JavaScript payloads in URL parameters or POST data
Network Indicators:
- HTTP requests containing script tags or JavaScript in text parameter
SIEM Query:
source="friendica_logs" AND (uri_path="*babel*" AND (param="*<script>*" OR param="*javascript:*"))