-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 KL-001-2024-009: Journyx Reflected Cross Site Scripting Title: Journyx Reflected Cross Site Scripting Advisory ID: KL-001-2024-009 Publication Date: 2024.08.07 Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2024-009.txt 1. Vulnerability Details Affected Vendor: Journyx Affected Product: Journyx (jtime) Affected Version: 11.5.4 Platform: GNU/Linux CWE Classification: CWE-81: Improper Neutralization of Script in an Error Message Web Page CVE ID: CVE-2024-6892 2. Vulnerability Description Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application. 3. Technical Description During the active directory login flow, if an error occurs, the user is redirected to a page containing an error message outlining the problem. The error message shown in the page response is derived from the "error_description" query parameter that appears in the URL. This parameter is not sanitized or validated prior to being reflected, allowing for an attacker to insert malicious HTML/JavaScript into the "error_description" parameter. This vulnerability can be exploited regardless of whether active directory authentication has been configured for the Journyx instance. 4. Mitigation and Remediation Recommendation The vendor reports that this issue was remediated in Journyx v13.0.0. For self-hosted instances of JournyX, additional security measures (such as input sanitization) can be added by monkey patching the PYC file responsible for handling request parameters (mycgi.pyc). 1) Rename "mycgi.pyc" to an alternative name, e.g. mycgi_original.pyc. $ mv wt_tar/pi/pylib/wtlib/mycgi.py wt_tar/pi/pylib/wtlib/mycgi_original.py 2) Create a file named "mycgi.py" in the same directory. $ touch wt_tar/pi/pylib/wtlib/mycgi.py 3) Insert the following code into the newly created "mycgi.py" from mycgi_original import * from html import escape def patch(): pdata = _parse() # force the value of "end_URL" to always be "wte" if pdata.get('end_URL'): pdata['end_URL'] = ['wte'] # sanitize user-controlled error messages for parameter in ['error', 'error_description']: if not pdata.get(parameter): continue pdata[parameter] = [escape(value) for value in pdata[parameter]] return pdata _parse = parse parse = patch Once these changes have been made, the JournyX native "mycgi.parse()" function will be overwritten with the "patch()" function located in the "mycgi.py" file. Relevant to this advisory, the patch provided above will replace special characters with their respective HTML entity representation for the "error" and "error_description" parameters. This list of parameters can be extended as needed. Additionally, if SSO is not required, requests to /jtcgi/r/adlogin/sso could be dropped without forwarding invoking FastCGI via a ModSecurity rule like the one below: SecRule REQUEST_URI "@contains adlogin/sso" "id:4,phase:2,deny,log,auditlog" 5. Credit This vulnerability was discovered by Jaggar Henry of KoreLogic, Inc. 6. Disclosure Timeline 2024.01.31 - KoreLogic notifies Journyx support of the intention to report vulnerabilities discovered in the licensed, on-premises version of the product. 2024.01.31 - Journyx acknowledges receipt. 2024.02.02 - KoreLogic requests a meeting with Journyx support to share vulnerability details. 2024.02.07 - KoreLogic reports vulnerability details to Journyx. 2024.02.09 - Journyx responds that this vulnerability has been remediated in the cloud-hosted version of the product. 2024.02.21 - KoreLogic offers to test the cloud version to confirm the fix; no response. 2024.07.01 - KoreLogic notifies Journyx of impending public disclosure. 2024.07.09 - Journyx confirms version number of the remediation. 2024.08.07 - KoreLogic public disclosure. 7. Proof of Concept The following URL contains the "error_description" parameter with a value of "%3Csvg%2fonload%3dprompt(%27KoreLogic%27)%3E": http://redacted.com:8080/jtcgi/r/adlogin/sso?code=1337&state=foobar&id_token=zoinks&error_description=%3Csvg%2fonload%3dprompt(%27KoreLogic%27)%3E&error=error This value is automatically URL decoded to "" and reflected into the page response:
Unable to complete sign-on attempt. This is possibly a configuration error in the application registration on the Identity Provider (IdP) side. The IdP server said:

error

Once this link is clicked or visited in a browser, the javascript function "prompt()" is executed, and a display box is presented, thereby validating the execution of arbitrary JavaScript. The contents of this advisory are copyright(c) 2024 KoreLogic, Inc. and are licensed under a Creative Commons Attribution Share-Alike 4.0 (United States) License: http://creativecommons.org/licenses/by-sa/4.0/ KoreLogic, Inc. is a founder-owned and operated company with a proven track record of providing security services to entities ranging from Fortune 500 to small and mid-sized companies. We are a highly skilled team of senior security consultants doing by-hand security assessments for the most important networks in the U.S. and around the world. We are also developers of various tools and resources aimed at helping the security community. https://www.korelogic.com/about-korelogic.html Our public vulnerability disclosure policy is available at: https://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy -----BEGIN PGP SIGNATURE----- iQJOBAEBCAA4FiEEB12WYZwbVwYTJ/b2DKLsCTlWkekFAma0B1EaHGRpc2Nsb3N1 cmVzQGtvcmVsb2dpYy5jb20ACgkQDKLsCTlWkemDVg//Vj5ed3EmwrvcZwlgNOKr NQT2Hd1ZdHrhbXTD1Q5TTLau4p+3xGdGAhqLF1EWip2Jr6SRI5y0SkXQy5VqXI2h AOlJZlmKS/pNIq4JQo0OajA21PbucZExxRNMPWQqS5v3ZwhdpW2xZmAt+ZUG18fp FoMU1dwmtaTIQeZhZgMKd0jclM5TMyJw231m4r4RmzUxRj9f0GG6IqK6JhG69/kL fyheTHdjLhpepkk3uxNymPldlRL4a78rNX8Qt1XNjqacQ4JJK0vyOn7jPnSH3Bo8 JRqBaWmIUbasrvvF/Xl9Z0X/3EwviEFTr2Bpc6BO/Xy6fECou78Xenb3rguNE5OR tXkoUByiIkLdI/myAb6OnAtGupQOe3tRXbLZYQLJEwIsJSMQ6HI4eqZidwnZV4h3 FpveFs2GcTyf9gb0pCkpT9uVqTjqMUOhQsBxFNfPF4s0G4UeBm/k1QhVBmNHsHfq VKRbxod3O52d2R7NjsrSeqPbIIL4UayrTalXW7QyjD+YONxzrsxMGC/pTYnrNqj+ BvV48g7250d8eDMrNNCV2HsSwcUcxz8mVChdUnXIVxE8tOAEWxYq7N9SMs8WFdAk Voh4fNHi84H8sg2dHrNju93VAN5W1fnLGzoYfJs+SVGkRrsT+0KfSUrdoPko5lvc 0v/cwEqdkYTn64C8p64EjBw= =VQ43 -----END PGP SIGNATURE-----