CVE-2024-24812

Frappe XSS vulnerability allows JS injection via malicious links pre-14.59.0.

• CVSS 5.4
• CWE-79
• Input Validation and Sanitization
• Remote

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting (XSS) which can be used to inject malicious JS code if user clicks on a malicious link. This vulnerability has been patched in versions 14.59.0 and 15.5.0. No known workarounds are available.

CVE

CVE-2024-24812

CWE

CWE-79

CVSS base score

5.4

Published

2024-02-07

OWASP

A07 Cross-Site Scripting (XSS)

Orthogonal defect classification

Interface

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Cross-Site Scripting (XSS)

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Frappe

Solution

Upgrade to Frappe version 14.59.0 or 15.5.0 or later.

from frappe import render_template

def render_with_user_input(template_name, user_input):
    """Vulnerable function that demonstrates the security issue."""
    context = {'user_input': user_input}
    return render_template(template_name, context)

user_input = "<script>alert('XSS');</script>"
unsafe_output = render_with_user_input('portal_page.html', user_input)

from frappe import render_template

def render(template_name, context):
    """Secure function that fixes the vulnerability."""
    context = {key: escape(value) for key, value in context.items()}
    return render_template(template_name, context)

def escape(value):
    """Secure function that fixes the vulnerability."""
    import html
    return html.escape(value)

user_input = "<script>alert('XSS');</script>"
context = {'user_input': user_input}
output = render('portal_page.html', context)

<script>alert('XSS Vulnerability Exploited');</script>

@misc{vaitp:cve202424812,
  title        = {{Frappe XSS vulnerability allows JS injection via malicious links pre-14.59.0.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-24812},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-24812/}}
}