CVE-2024-26318: Serenity cross-site scripting in login page return URL

CVE-2024-26318 · Severity: low · CVSS 3.1 · Published 2024-02-19

Serenity is a web application development framework used to build business applications. The framework's login page accepted arbitrary return URLs from email links without proper validation, allowing attackers to craft phishing emails that execute malicious scripts when users clicked them. This could lead to credential theft, session hijacking, or malware distribution. The issue was remediated in version 6.8.0 by restricting return URLs to local paths only.

Technologies: Serenity.Net.Core (NuGet). Vendors: npm, NuGet.

Quick answers

Is CVE-2024-26318 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-26318 being exploited in the wild.
How severe is CVE-2024-26318?
Low severity, with a CVSS score of 3.1, published 19 February 2024.
Which products and versions are affected?
@serenity-is/corelib (npm) SEMVER:introduced=0,fixed=6.8.0; Serenity.Net.Core (NuGet) ECOSYSTEM:introduced=0,fixed=6.8.0; Serenity Corelib before 6.8.0.
Is there a fix for CVE-2024-26318?
Yes. @serenity-is/corelib (npm): upgrade to 6.8.0 or later; Serenity.Net.Core (NuGet): upgrade to 6.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-26318 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-26318?
Check whether you run @serenity-is/corelib (npm), Serenity.Net.Core (NuGet) or Serenity Corelib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @serenity-is/corelib (npm): upgrade to 6.8.0 or later
    npm install @serenity-is/corelib@6.8.0
  • Serenity.Net.Core (NuGet): upgrade to 6.8.0 or later
    dotnet add package Serenity.Net.Core --version 6.8.0

Technical details

This is a reflected cross-site scripting (CWE-79) vulnerability in the LoginPage.tsx component of Serenity. The root cause is insufficient validation of the return URL parameter passed to the login page, which was previously accepted regardless of its origin. An attacker can craft a malicious email containing a login link with a return URL pointing to an external domain or containing JavaScript (e.g., javascript: protocol or data: URI), which the page would redirect to or execute after authentication. The attack vector is primarily email-based social engineering combined with network access to the application. The fix validates that return URLs must begin with a forward slash (/), ensuring they point to internal application paths only. All versions before 6.8.0 are affected, across both the NuGet Serenity.Net.Core package and the npm @serenity-is/corelib package.

Affected products

  • Serenity Serenity.Net.Core before 6.8.0
  • Serenity @serenity-is/corelib before 6.8.0

Identifiers

  • CVE-2024-26318
  • GHSA-5jjq-8cvj-v6m9

Timeline

  • 2024-02-19: disclosed
  • 2023-08-14: patched: Fix released in version 6.8.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.