CVE-2024-8113
📋 TL;DR
This stored cross-site scripting (XSS) vulnerability in pretix allows malicious event organizers to inject HTML tags into email previews on the settings page. While the default Content Security Policy prevents script execution, a successful CSP bypass could enable attackers to impersonate other organizers or staff users. Only pretix instances with untrusted event organizers are affected.
💻 Affected Systems
- pretix
📦 What is this software?
Pretix by Pretix
⚠️ Risk & Real-World Impact
Worst Case
With CSP bypass, attacker impersonates administrators to steal credentials, modify events, or access sensitive data
Likely Case
Limited impact due to CSP protection; potential for HTML injection in email previews only
If Mitigated
No impact with proper CSP implementation and trusted organizers
🎯 Exploit Status
Requires authenticated organizer access AND CSP bypass (no known bypass exists)
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.7.1
Vendor Advisory: https://pretix.eu/about/en/blog/20240823-release-2024-7-1/
Restart Required: Yes
Instructions:
1. Backup your pretix instance. 2. Update to pretix 2024.7.1 or later. 3. Restart the pretix service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Restrict organizer permissions
allOnly grant organizer permissions to trusted users
Enforce strict CSP
allEnsure Content Security Policy is properly configured and not weakened
🧯 If You Can't Patch
- Implement strict access controls for organizer roles
- Monitor for suspicious HTML content in email previews and organizer activities
🔍 How to Verify
Check if Vulnerable:
Check pretix version; if version is 2024.7.0 or earlier, system is vulnerableCheck Version:
python -c "import pretix; print(pretix.__version__)" or check admin interfaceVerify Fix Applied:
Confirm pretix version is 2024.7.1 or later📡 Detection & Monitoring
Log Indicators:
- Unusual HTML content in email preview generation logs
- Multiple organizer account modifications
Network Indicators:
- Suspicious HTML payloads in POST requests to organizer settings
SIEM Query:
source="pretix" AND (event="email_preview" OR event="organizer_settings") AND message="*<script>*"