CVE-2024-30154
📋 TL;DR
HCL SX has a cross-site request forgery (CSRF) vulnerability that allows attackers to trick authenticated users into performing unauthorized actions on their behalf. This affects all users of vulnerable HCL SX installations who access the application through a web browser.
💻 Affected Systems
- HCL SX
📦 What is this software?
Hcl Sx by Hcltech
⚠️ Risk & Real-World Impact
Worst Case
An attacker could perform administrative actions like creating new users, changing configurations, or deleting data by tricking an administrator into clicking a malicious link.
Likely Case
Attackers could modify user settings, change permissions, or perform other actions within the authenticated user's privilege level.
If Mitigated
With proper CSRF protections and user awareness, the risk is significantly reduced as legitimate requests would be validated.
🎯 Exploit Status
CSRF attacks typically require minimal technical skill but need the victim to be authenticated and tricked into interacting with malicious content.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.0.2
Vendor Advisory: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0119437
Restart Required: Yes
Instructions:
1. Download HCL SX version 12.0.2 from HCL support portal. 2. Backup current installation and data. 3. Apply the update following HCL's upgrade documentation. 4. Restart the application services.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd anti-CSRF tokens to all state-changing requests
SameSite Cookie Attribute
allSet SameSite=Strict or Lax attributes on session cookies
Set-Cookie: sessionid=xxx; SameSite=Strict; Secure; HttpOnly
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to detect and block CSRF patterns
- Enforce strict referrer policy headers and educate users about phishing risks
🔍 How to Verify
Check if Vulnerable:
Check HCL SX version via admin console or configuration files. If version is below 12.0.2, system is vulnerable.Check Version:
Check admin console or review installation logs for version informationVerify Fix Applied:
Confirm version is 12.0.2 or higher and test that state-changing requests now require CSRF tokens.📡 Detection & Monitoring
Log Indicators:
- Multiple state-changing requests from same user without CSRF tokens
- Requests with missing or invalid anti-CSRF headers
Network Indicators:
- HTTP POST requests to HCL SX endpoints without Referer headers or CSRF tokens
SIEM Query:
source="hcl_sx_logs" AND (http_method="POST" OR http_method="PUT" OR http_method="DELETE") AND NOT csrf_token=*