CVE-2024-54951
📋 TL;DR
Monica 4.1.2 contains a stored cross-site scripting (XSS) vulnerability in the 'HOW YOU MET' contact customization feature. An authenticated attacker can create malicious contacts that execute JavaScript in victims' browsers when viewing those contacts. This affects all Monica 4.1.2 installations with default configurations.
💻 Affected Systems
- Monica
📦 What is this software?
Monica by Monicahq
⚠️ Risk & Real-World Impact
Worst Case
An attacker could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or deploy malware through browser exploitation.
Likely Case
Attackers with user accounts could steal other users' session tokens, perform unauthorized actions, or deface contact information.
If Mitigated
With proper input validation and output encoding, malicious scripts would be rendered harmless as text rather than executed.
🎯 Exploit Status
Exploit requires authenticated user account. Public proof-of-concept available on GitHub shows exact payload structure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.3 or later
Vendor Advisory: https://github.com/monicahq/monica/releases
Restart Required: Yes
Instructions:
1. Backup your Monica database. 2. Update Monica to version 4.1.3 or newer via git pull or package manager. 3. Run database migrations if required. 4. Restart the web server and queue workers.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize contact field inputs before storage
Implement input sanitization in contact creation/update endpoints
Output Encoding
allApply proper HTML encoding when displaying contact customization fields
Ensure all contact field outputs use htmlspecialchars() or equivalent encoding
🧯 If You Can't Patch
- Disable contact creation for non-admin users
- Implement web application firewall (WAF) rules to block XSS payloads in contact fields
🔍 How to Verify
Check if Vulnerable:
Check if Monica version is exactly 4.1.2. Attempt to create contact with <script>alert('XSS')</script> in 'HOW YOU MET' field and see if script executes when viewing.Check Version:
Check .env file for APP_VERSION or view footer in Monica web interfaceVerify Fix Applied:
After updating to 4.1.3+, attempt same XSS payload - it should display as plain text rather than executing.📡 Detection & Monitoring
Log Indicators:
- Unusual contact creation patterns
- JavaScript payloads in contact field POST requests
Network Indicators:
- POST requests to contact endpoints containing script tags or JavaScript
SIEM Query:
web_requests WHERE url_path CONTAINS '/contacts' AND request_body CONTAINS '<script>'