CVE-2024-29877
📋 TL;DR
This is a Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2 that allows attackers to inject malicious scripts via the 'expense_category_name' parameter in the expense categories edit page. When exploited, it enables session hijacking by tricking victims into clicking specially crafted URLs. Organizations using Sentrifugo 3.2 for HR management are affected.
💻 Affected Systems
- Sentrifugo
📦 What is this software?
Sentrifugo by Sapplica
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, data theft, and potential privilege escalation leading to full system compromise.
Likely Case
Session hijacking allowing unauthorized access to HR data and system functionality.
If Mitigated
Limited impact with proper input validation and output encoding in place.
🎯 Exploit Status
Requires user interaction (clicking malicious link) but uses standard XSS techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for latest patched version
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sentrifugo
Restart Required: No
Instructions:
1. Review vendor advisory 2. Apply latest Sentrifugo security patches 3. Validate input sanitization in expense_category_name parameter
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation for expense_category_name parameter
Add input sanitization in /sentrifugo/index.php/expenses/expensecategories/edit controller
Content Security Policy
allImplement CSP headers to restrict script execution
Add 'Content-Security-Policy' header with script-src directives
🧯 If You Can't Patch
- Implement WAF rules to block XSS payloads in expense_category_name parameter
- Restrict access to expense categories module to authorized users only
🔍 How to Verify
Check if Vulnerable:
Test if expense_category_name parameter accepts and executes script tags like <script>alert('XSS')</script>Check Version:
Check Sentrifugo version in application configuration or admin panelVerify Fix Applied:
Verify input is properly sanitized and script tags are not executed📡 Detection & Monitoring
Log Indicators:
- Unusual expense_category_name parameter values containing script tags or JavaScript
Network Indicators:
- Requests to /sentrifugo/index.php/expenses/expensecategories/edit with suspicious parameters
SIEM Query:
source="web_logs" AND uri="/sentrifugo/index.php/expenses/expensecategories/edit" AND (param="expense_category_name" AND value MATCHES "<script|javascript:")