CVE-2024-41504
📋 TL;DR
Jetimob Plataforma Imobiliaria 20240627-0 contains a stored cross-site scripting (XSS) vulnerability in the 'Descrico' field when creating or editing activities in the Opportunities section. This allows attackers to inject malicious JavaScript that executes in users' browsers when viewing affected content. All users of the vulnerable version are affected.
💻 Affected Systems
- Jetimob Plataforma Imobiliaria
📦 What is this software?
Imobiliaria by Jetimob
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on client systems.
Likely Case
Session hijacking, credential theft, or defacement of application content through injected scripts.
If Mitigated
Limited impact with proper input validation, output encoding, and Content Security Policy (CSP) headers in place.
🎯 Exploit Status
Exploitation requires authentication to access the activity creation/edit functionality. Public proof-of-concept available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://jetimob.com
Restart Required: No
Instructions:
No official patch available. Monitor vendor website for updates and apply when released.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize HTML/JavaScript in the Descrico field
Implement input sanitization in the activity creation/edit endpoint
Content Security Policy
allImplement strict CSP headers to prevent execution of inline scripts
Add 'Content-Security-Policy: script-src 'self'' header to web server configuration
🧯 If You Can't Patch
- Restrict access to activity creation/edit functionality to trusted users only
- Implement web application firewall (WAF) rules to block XSS payloads in the Descrico parameter
🔍 How to Verify
Check if Vulnerable:
Test by creating an activity with JavaScript payload in Descrico field and verify if it executes when viewingCheck Version:
Check application version in admin panel or about pageVerify Fix Applied:
Test that JavaScript payloads in Descrico field are properly sanitized and do not execute📡 Detection & Monitoring
Log Indicators:
- Unusual activity creation/modification patterns
- JavaScript code in activity description fields
Network Indicators:
- HTTP requests with JavaScript payloads in Descrico parameter
SIEM Query:
source="web_logs" AND (descrico CONTAINS "<script>" OR descrico CONTAINS "javascript:")