CVE-2024-35224

Stored Cross-Site Scripting (XSS) in OpenProject

Severity Score

7.6

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

OpenProject is the leading open source project management software. OpenProject utilizes `tablesorter` inside of the Cost Report feature. This dependency, when misconfigured, can lead to Stored XSS via `{icon}` substitution in table header values. This attack requires the permissions "Edit work packages" as well as "Add attachments". A project admin could attempt to escalate their privileges by sending this XSS to a System Admin. Otherwise, if a full System Admin is required, then this attack is significantly less impactful. By utilizing a ticket's attachment, you can store javascript in the application itself and bypass the application's CSP policy to achieve Stored XSS. This vulnerability has been patched in version(s) 14.1.0, 14.0.2 and 13.4.2.

OpenProject es el software líder de gestión de proyectos de código abierto. OpenProject utiliza "tablesorter" dentro de la función Informe de costos. Esta dependencia, cuando está mal configurada, puede provocar que se almacene XSS mediante la sustitución de `{icon}` en los valores del encabezado de la tabla. Este ataque requiere los permisos "Editar paquetes de trabajo", así como "Agregar archivos adjuntos". Un administrador de proyecto podría intentar aumentar sus privilegios enviando este XSS a un administrador del sistema. De lo contrario, si se requiere un administrador del sistema completo, este ataque tendrá un impacto significativamente menor. Al utilizar el archivo adjunto de un ticket, puede almacenar javascript en la propia aplicación y omitir la política CSP de la aplicación para lograr Stored XSS. Esta vulnerabilidad ha sido parcheada en las versiones 14.1.0, 14.0.2 y 13.4.2.

*Credits: N/A

CVSS Scores

GitHubv3.1 7.6

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-05-14 CVE Reserved
2024-05-23 CVE Published
2024-05-24 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CAPEC

References (2)

URL	Tag	Source
https://community.openproject.org/projects/openproject/work_packages/55198/relations	X_refsource_misc
https://github.com/opf/openproject/security/advisories/GHSA-h26c-j8wg-frjc	X_refsource_confirm

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Opf Search vendor "Opf"		Openproject Search vendor "Opf" for product "Openproject"				>= 13.4.0 < 13.4.2 Search vendor "Opf" for product "Openproject" and version " >= 13.4.0 < 13.4.2"		en		Affected
Opf Search vendor "Opf"		Openproject Search vendor "Opf" for product "Openproject"				< 14.1.0 Search vendor "Opf" for product "Openproject" and version " < 14.1.0"		en		Affected
Opf Search vendor "Opf"		Openproject Search vendor "Opf" for product "Openproject"				>= 14.0.0 < 14.0.2 Search vendor "Opf" for product "Openproject" and version " >= 14.0.0 < 14.0.2"		en		Affected