CVE-2024-42346
📋 TL;DR
This CVE describes a stored cross-site scripting (XSS) vulnerability in Galaxy's editor visualization endpoint. Attackers can inject malicious HTML/JavaScript that executes when users edit visualizations, potentially compromising user sessions or performing unauthorized actions. All Galaxy installations using affected versions are vulnerable.
💻 Affected Systems
- Galaxy
📦 What is this software?
Galaxy by Galaxyproject
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, compromise user accounts, execute arbitrary actions as authenticated users, and potentially pivot to internal systems.
Likely Case
Session hijacking, credential theft, unauthorized data access, and manipulation of Galaxy workflows and data.
If Mitigated
Limited to isolated session compromise if proper network segmentation and user privilege controls are implemented.
🎯 Exploit Status
Exploitation requires the ability to create or edit visualizations, but once stored, the payload executes for any user who views/edit the visualization.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patches applied to all supported branches and releases back to release_20.05
Vendor Advisory: https://github.com/galaxyproject/galaxy/security/advisories/GHSA-x6w7-3gwf-qr9r
Restart Required: Yes
Instructions:
1. Identify your Galaxy version. 2. Update to the latest patched version of your branch. 3. Restart Galaxy services. 4. Verify the patch is applied.
🧯 If You Can't Patch
- Disable the /visualizations endpoint if not required
- Implement strict Content Security Policy (CSP) headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check Galaxy version against affected range (release_20.05 and later). Review if visualization editor is accessible.Check Version:
Check Galaxy configuration files or run 'galaxy --version' if available in deploymentVerify Fix Applied:
Verify Galaxy version is updated to a patched release. Test that HTML/JavaScript injection in visualization editor is properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual visualization creation/edit patterns
- Suspicious HTML/JavaScript payloads in visualization data
Network Indicators:
- Requests to /visualizations endpoint with encoded payloads
- Unexpected external connections from Galaxy sessions
SIEM Query:
source="galaxy" AND (uri_path="/visualizations" AND (content LIKE "%<script>%" OR content LIKE "%javascript:%"))