CVE-2024-56358
📋 TL;DR
This vulnerability in grist-core allows cross-site scripting (XSS) attacks via malicious SVG attachments. When a user previews an attachment containing JavaScript in an SVG file, the code executes in the context of their current page, potentially compromising their account. All users of affected grist-core versions who preview attachments are at risk.
💻 Affected Systems
- grist-core
📦 What is this software?
Grist Core by Getgrist
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover leading to data theft, privilege escalation, or further attacks on the grist-core instance and connected systems.
Likely Case
Session hijacking, data exfiltration, or unauthorized actions performed within the user's account context.
If Mitigated
Limited impact if users only preview attachments from trusted sources, with potential for isolated account compromise.
🎯 Exploit Status
Exploitation requires social engineering to get users to preview malicious attachments, but the technical execution is straightforward once the malicious SVG is loaded.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.2
Vendor Advisory: https://github.com/gristlabs/grist-core/security/advisories/GHSA-jvfm-gf4f-33q3
Restart Required: Yes
Instructions:
1. Backup your grist-core data and configuration
2. Stop the grist-core service
3. Update to version 1.3.2 using your package manager or manual installation
4. Restart the grist-core service
5. Verify the update was successful
🔧 Temporary Workarounds
Disable attachment preview
allConfigure grist-core to disable attachment preview functionality
Modify grist-core configuration to set ATTACHMENT_PREVIEW=false
🧯 If You Can't Patch
- Implement strict document access controls and only allow trusted users to upload attachments
- Educate users to never preview attachments from untrusted sources or unknown documents
🔍 How to Verify
Check if Vulnerable:
Check if grist-core version is below 1.3.2Check Version:
grist-core --version or check package managerVerify Fix Applied:
Confirm grist-core version is 1.3.2 or higher and test that SVG attachments no longer execute JavaScript when previewed📡 Detection & Monitoring
Log Indicators:
- Unusual attachment preview activity
- Multiple failed authentication attempts following attachment previews
- Suspicious user agent strings during attachment access
Network Indicators:
- Unusual outbound connections following attachment previews
- Requests to known malicious domains from grist-core server
SIEM Query:
source="grist-core" AND (event="attachment_preview" OR event="svg_load")