CVE-2024-55074
📋 TL;DR
This stored XSS vulnerability in Grocy's edit profile function allows attackers to upload malicious HTML or SVG files that execute arbitrary JavaScript when viewed. This can lead to privilege escalation by compromising admin accounts. All Grocy users up to version 4.3.0 are affected.
💻 Affected Systems
- Grocy
📦 What is this software?
Grocy by Grocy Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through admin account takeover, data theft, and complete control over the Grocy instance.
Likely Case
Session hijacking, data manipulation, and unauthorized access to sensitive household inventory data.
If Mitigated
Limited impact with proper input validation and output encoding preventing script execution.
🎯 Exploit Status
Requires user interaction (viewing malicious content) and file upload capability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 4.3.0
Vendor Advisory: https://github.com/grocy/grocy/security/advisories
Restart Required: No
Instructions:
1. Update Grocy to the latest version. 2. Verify the edit profile function properly validates and sanitizes file uploads. 3. Clear any cached malicious files.
🔧 Temporary Workarounds
Disable file uploads in edit profile
allTemporarily disable HTML/SVG file upload functionality in the edit profile feature.
Modify Grocy configuration to restrict file upload types
Implement Content Security Policy
allAdd CSP headers to prevent execution of inline scripts and untrusted sources.
Add 'Content-Security-Policy' header with script-src 'self'
🧯 If You Can't Patch
- Implement strict file type validation to block HTML/SVG uploads
- Deploy WAF with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Check if Grocy version is 4.3.0 or earlier and test if edit profile accepts HTML/SVG files.Check Version:
Check Grocy web interface footer or configuration files for version numberVerify Fix Applied:
Test that HTML/SVG files are properly sanitized or rejected when uploaded via edit profile.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to edit profile
- HTML/SVG files in upload directories
- JavaScript errors from unexpected sources
Network Indicators:
- Requests for uploaded HTML/SVG files with suspicious content
SIEM Query:
source="grocy" AND (file_upload="*.html" OR file_upload="*.svg")