CVE-2024-39094
📋 TL;DR
Friendica 2024.03 contains a cross-site scripting vulnerability in profile settings fields that allows attackers to inject malicious scripts. This affects all users who can access profile settings, potentially compromising their sessions or stealing credentials. The vulnerability exists in the homepage, xmpp, and matrix parameter fields.
💻 Affected Systems
- Friendica
📦 What is this software?
Friendica by Friendica
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform account takeover, redirect users to malicious sites, or execute actions on behalf of authenticated users.
Likely Case
Attackers could steal session tokens or credentials through crafted profile links, leading to account compromise.
If Mitigated
With proper input validation and output encoding, the risk is limited to minor data leakage or UI disruption.
🎯 Exploit Status
Exploitation requires authenticated access to profile settings or tricking users into viewing malicious profile content.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.08
Vendor Advisory: https://friendi.ca/2024/08/17/friendica-2024-08-released/
Restart Required: No
Instructions:
1. Backup your Friendica installation and database. 2. Download Friendica 2024.08 from the official repository. 3. Replace all files with the new version. 4. Run any database migrations if prompted. 5. Clear caches and verify functionality.
🔧 Temporary Workarounds
Input Validation Filter
allAdd custom input validation for homepage, xmpp, and matrix fields to sanitize HTML/JavaScript content
# Modify profile settings validation in your Friendica installation
# Add HTML entity encoding for these fields before storage
🧯 If You Can't Patch
- Disable profile editing functionality temporarily
- Implement web application firewall rules to block XSS payloads in profile parameters
🔍 How to Verify
Check if Vulnerable:
Check if Friendica version is 2024.03 or earlier. Test by attempting to inject script tags in homepage, xmpp, or matrix profile fields.Check Version:
Check Friendica version in admin panel or view version.php fileVerify Fix Applied:
After upgrading to 2024.08, attempt XSS injection in profile fields and verify scripts are properly sanitized and not executed.📡 Detection & Monitoring
Log Indicators:
- Unusual script tags or JavaScript in profile field updates
- Multiple failed XSS attempts in profile submissions
Network Indicators:
- Suspicious redirects from profile pages
- Unexpected external script loads from profile content
SIEM Query:
Search for patterns like <script>, javascript:, or encoded payloads in profile update logs