CVE-2024-5711
📋 TL;DR
A stored Cross-Site Scripting (XSS) vulnerability in the stitionai/devika chat feature allows attackers to inject malicious JavaScript payloads that execute in users' browsers. This affects all versions of the application and can lead to credential theft and data exfiltration from chat logs and projects.
💻 Affected Systems
- stitionai/devika
📦 What is this software?
Devika by Stitionai
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator credentials, compromise all user accounts, exfiltrate sensitive project data, and establish persistent access to the application.
Likely Case
Attackers steal user session cookies and credentials, access chat history containing sensitive information, and potentially pivot to other systems.
If Mitigated
With proper input validation and output encoding, the vulnerability is eliminated and no malicious scripts can execute.
🎯 Exploit Status
Exploitation requires access to the chat interface but payloads are simple JavaScript injections.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patched in commit 6acce21fb08c3d1123ef05df6a33912bf0ee77c2
Vendor Advisory: https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2
Restart Required: Yes
Instructions:
1. Update to the latest version of stitionai/devika. 2. Apply commit 6acce21fb08c3d1123ef05df6a33912bf0ee77c2. 3. Restart the application server.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to reject or sanitize HTML/JavaScript in chat messages
Implement input sanitization using libraries like DOMPurify or similar XSS prevention libraries
Content Security Policy
allImplement strict CSP headers to prevent inline script execution
Add header: Content-Security-Policy: script-src 'self'
🧯 If You Can't Patch
- Disable the chat feature entirely if not essential
- Implement a web application firewall (WAF) with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Test chat input with payload: <script>alert('XSS')</script> and check if script executesCheck Version:
Check git commit hash or application version in deployment configurationVerify Fix Applied:
Test with same payload after patch - script should not execute and input should be sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual chat messages containing script tags or JavaScript code
- Multiple failed login attempts from unexpected locations
Network Indicators:
- Outbound connections to suspicious domains from user browsers
- Unusual data exfiltration patterns
SIEM Query:
source=application_logs message="*<script>*" OR message="*javascript:*"