CVE-2024-42904
📋 TL;DR
This cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows attackers to inject malicious scripts into the client name parameter, which could execute arbitrary JavaScript in users' browsers. It affects all SysPass 3.2.x installations with the vulnerable ClientController.php file. Attackers could steal session cookies, redirect users, or perform actions on their behalf.
💻 Affected Systems
- SysPass
📦 What is this software?
Syspass by Syspass
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full control of the password manager, exfiltrate all stored credentials, and compromise the entire credential management system.
Likely Case
Attackers steal user session cookies, access sensitive passwords they're authorized to view, and potentially pivot to other systems using stolen credentials.
If Mitigated
With proper input validation and output encoding, malicious scripts are neutralized, preventing execution and limiting impact to failed injection attempts.
🎯 Exploit Status
Exploitation requires authentication but is straightforward once authenticated. Public proof-of-concept demonstrates the injection technique.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check SysPass repository for latest version
Vendor Advisory: https://github.com/nuxsmin/sysPass/security/advisories
Restart Required: No
Instructions:
1. Backup your SysPass installation and database. 2. Update to the latest SysPass version from the official repository. 3. Verify the ClientController.php file has proper input validation and output encoding. 4. Clear browser caches and test functionality.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side input validation to sanitize the name parameter before processing
Modify /Controllers/ClientController.php to include htmlspecialchars() or similar sanitization on line 89
Web Application Firewall Rule
allBlock malicious script patterns in the name parameter
Add WAF rule to detect and block script tags, JavaScript events, and other XSS patterns in POST requests to ClientController.php
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to prevent script execution from untrusted sources
- Disable or restrict access to the vulnerable ClientController.php endpoint using web server configuration or authentication middleware
🔍 How to Verify
Check if Vulnerable:
Check if your SysPass version is 3.2.x and examine /Controllers/ClientController.php line 89 for missing input sanitizationCheck Version:
Check SysPass version in web interface or examine version files in installation directoryVerify Fix Applied:
Test by attempting to inject basic XSS payloads into the client name field and verify they are properly encoded or rejected📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to ClientController.php with script-like content in parameters
- Multiple failed login attempts followed by successful authentication and parameter manipulation
Network Indicators:
- HTTP requests containing script tags, JavaScript functions, or encoded payloads in the name parameter
- Outbound connections to suspicious domains following successful authentication
SIEM Query:
source="web_server_logs" AND (uri="/Controllers/ClientController.php" AND (param_name="name" AND param_value MATCHES "(?i)(script|javascript|onload|onerror)"))