CVE-2024-51093
📋 TL;DR
A stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT v7.0.13 allows attackers to upload malicious XML files containing JavaScript. When executed, this can escalate privileges to super admin, compromising the entire Snipe-IT system. All users running the vulnerable version are affected.
💻 Affected Systems
- Snipe-IT
📦 What is this software?
Snipe It by Snipeitapp
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains super admin privileges, enabling full control over the Snipe-IT instance, data theft, system compromise, and potential lateral movement.
Likely Case
Unauthorized privilege escalation leading to data manipulation, configuration changes, and further exploitation within the Snipe-IT environment.
If Mitigated
Limited impact with proper input validation, file upload restrictions, and privilege separation in place.
🎯 Exploit Status
Exploit requires authenticated access to upload files; public proof-of-concept exists in the provided reference.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v7.0.14 or later
Vendor Advisory: https://github.com/snipe/snipe-it/releases
Restart Required: No
Instructions:
1. Backup your Snipe-IT database and files. 2. Update to Snipe-IT v7.0.14 or newer via git pull or package update. 3. Verify the update applied correctly.
🔧 Temporary Workarounds
Restrict File Uploads
allTemporarily disable or restrict XML file uploads in Snipe-IT configuration.
Modify Snipe-IT config to block .xml uploads or implement strict validation.
Input Sanitization
allImplement server-side validation to sanitize XML file content before processing.
Add custom validation in Snipe-IT to strip JavaScript from XML files.
🧯 If You Can't Patch
- Implement strict access controls to limit file upload permissions to trusted users only.
- Deploy a web application firewall (WAF) with XSS protection rules to block malicious payloads.
🔍 How to Verify
Check if Vulnerable:
Check if running Snipe-IT v7.0.13 by viewing the version in the web interface or checking the application files.Check Version:
Check Snipe-IT web interface or run: grep -r "version" /path/to/snipe-it/config filesVerify Fix Applied:
Confirm version is v7.0.14 or newer and test file upload functionality with safe XML files.📡 Detection & Monitoring
Log Indicators:
- Unusual XML file uploads, especially with JavaScript content in logs.
- Privilege escalation attempts or admin user creation from unexpected sources.
Network Indicators:
- HTTP POST requests uploading XML files to Snipe-IT endpoints.
- Suspicious JavaScript execution in response to file uploads.
SIEM Query:
source="snipe-it" AND (file_upload="*.xml" OR http_method="POST" AND uri="/uploads")