CVE-2024-37304
📋 TL;DR
NuGet Gallery has a cross-site scripting vulnerability where autolinks in Markdown content are not properly sanitized. Attackers can inject malicious JavaScript via autolinks like <javascript:alert(1)>, which executes when users view the content. This affects all NuGet Gallery instances running versions before 2024.05.28.
💻 Affected Systems
- NuGet Gallery
📦 What is this software?
Nugetgallery by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, deface pages, or redirect users to malicious sites.
Likely Case
Attackers inject malicious scripts to steal user credentials or session tokens from authenticated users viewing package descriptions.
If Mitigated
With proper input validation and output encoding, the malicious scripts would be rendered harmless as text.
🎯 Exploit Status
Exploitation requires ability to submit Markdown content (typically authenticated users). The vulnerability is well-documented with example payloads in the advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.05.28
Vendor Advisory: https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-gwjh-c548-f787
Restart Required: Yes
Instructions:
1. Update NuGet Gallery to version 2024.05.28 or later. 2. Restart the application. 3. Verify the fix by checking the version and testing autolink sanitization.
🔧 Temporary Workarounds
Disable Markdown autolinks
allConfigure NuGet Gallery to disable or restrict Markdown autolink processing.
Implement WAF rules
allAdd web application firewall rules to block JavaScript protocol in autolinks.
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to prevent script execution
- Enable input validation to reject Markdown containing JavaScript protocol in autolinks
🔍 How to Verify
Check if Vulnerable:
Test by creating a package description with <javascript:alert('test')> and checking if script executes.Check Version:
Check NuGet Gallery version in admin interface or application configuration.Verify Fix Applied:
After patching, test the same payload - it should be rendered as plain text or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual Markdown submissions containing JavaScript protocol
- Multiple failed autolink validation attempts
Network Indicators:
- HTTP requests with JavaScript payloads in Markdown parameters
SIEM Query:
search 'javascript:' in request_body AND path contains '/api/v2/package' OR '/packages'🔗 References
- https://github.com/NuGet/NuGetGallery/commit/c52b023659f4ad7b626874c1063f2b5e878a4fe0
- https://github.com/NuGet/NuGetGallery/pull/9836
- https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-gwjh-c548-f787
- https://github.com/NuGet/NuGetGallery/commit/c52b023659f4ad7b626874c1063f2b5e878a4fe0
- https://github.com/NuGet/NuGetGallery/pull/9836
- https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-gwjh-c548-f787
