CVE-2024-41705
📋 TL;DR
A stored cross-site scripting (XSS) vulnerability in Archer Platform allows authenticated attackers to inject malicious scripts into application data stores. When other users access these stores through their browsers, the scripts execute within the vulnerable application's context. This affects Archer Platform versions before specific patched releases.
💻 Affected Systems
- Archer Platform
📦 What is this software?
Archer by Archerirm
Archer by Archerirm
Archer by Archerirm
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as victims, redirect to malicious sites, or compromise user accounts and sensitive data.
Likely Case
Session hijacking, credential theft, or unauthorized actions performed in victims' sessions.
If Mitigated
Limited impact with proper input validation, output encoding, and content security policies in place.
🎯 Exploit Status
Exploitation requires authenticated access; stored XSS typically has low complexity once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.14.0.4, 6.13.0.4, or 2024.06
Vendor Advisory: https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/739717
Restart Required: Yes
Instructions:
1. Download the appropriate patch from Archer support. 2. Apply the patch following Archer's upgrade documentation. 3. Restart Archer services. 4. Verify the update was successful.
🔧 Temporary Workarounds
Input Validation and Output Encoding
allImplement server-side input validation and output encoding for user-supplied data in Archer customizations.
Content Security Policy
allDeploy a strict Content Security Policy to mitigate XSS impact.
🧯 If You Can't Patch
- Restrict user permissions to minimize who can inject content.
- Monitor application logs for suspicious HTML/JavaScript injection attempts.
🔍 How to Verify
Check if Vulnerable:
Check Archer Platform version via Archer Admin Console or version files.Check Version:
Check Archer Admin Console or consult Archer documentation for version verification commands.Verify Fix Applied:
Confirm version is 6.14.0.4, 6.13.0.4, or 2024.06 or later.📡 Detection & Monitoring
Log Indicators:
- Unusual HTML or JavaScript in user input logs
- Multiple failed login attempts followed by successful ones
Network Indicators:
- Unexpected outbound connections from Archer servers
- Suspicious payloads in HTTP requests
SIEM Query:
source="archer_logs" AND (message="*script*" OR message="*javascript*" OR message="*onerror*" OR message="*onload*")🔗 References
- https://www.archerirm.community/t5/platform-announcements/announcing-archer-platform-release-2024-06/ta-p/722094
- https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/739717
- https://www.archerirm.community/t5/platform-announcements/announcing-archer-platform-release-2024-06/ta-p/722094
- https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/739717
