Full Report
CERT Polska has received a report about 2 XSS (Cross-site Scripting) vulnerabilities (CVE-2024-7874 and CVE-2024-7875) found in Tungsten Automation (formerly Kofax) TotalAgility software.
Analysis Summary
# Vulnerability: Cross-Site Scripting (XSS) in Tungsten TotalAgility
## CVE Details
- CVE ID: CVE-2024-7874, CVE-2024-7875
- CVSS Score: Not explicitly provided in the text (Severity assigned based on CWE and impact)
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation (XSS))
## Affected Systems
- Products: Tungsten Automation (formerly Kofax) TotalAgility software
- Versions: All through 7.9.0.25.0.954 (Newer versions might also be vulnerable as vendor confirmation was unavailable)
- Configurations: Access via endpoints `/TotalAgility/Kofax/BrowserDevice/ScanFront.aspx` and `/TotalAgility/Kofax/BrowserDevice/ScanFrontDebug.aspx` using POST requests.
## Vulnerability Description
The weaknesses are two distinct Reflected Cross-Site Scripting (XSS) vulnerabilities. They arise from improper neutralization of user-supplied input in various parameters sent to specific TotalAgility endpoints, allowing an unauthenticated user to inject malicious JavaScript code.
The vulnerable parameters and endpoints are:
1. `_mfpConnectionId`: Sent to endpoints `/TotalAgility/Kofax/BrowserDevice/ScanFront.aspx` and `/TotalAgility/Kofax/BrowserDevice/ScanFrontDebug.aspx`.
2. `_mfpScreenResolutionWidth`: Sent to endpoint `/TotalAgility/Kofax/BrowserDevice/ScanFront.aspx`.
## Exploitation
- Status: PoC available (Implied by the technical report, though not explicitly stated as public PoC, the details provided suggest exploitability is well-defined).
- Complexity: Medium (Requires retrieving/generating a proper VIEWSTATE parameter, in addition to using POST requests).
- Attack Vector: Network
## Impact
- Confidentiality: Information Leakage (due to JavaScript execution)
- Integrity: Potential modification of user data/session state (typical XSS impact)
- Availability: Potential denial of service (typical XSS impact)
## Remediation
### Patches
- Patches addressing CVE-2024-7874 and CVE-2024-7875 are not listed, but users should check the latest vendor advisories from Tungsten Automation for updates to versions newer than 7.9.0.25.0.954.
### Workarounds
- Implement WAF rules or input validation specifically targeting the parameters `_mfpConnectionId` and `_mfpScreenResolutionWidth` in POST requests to the specified `/BrowserDevice/` endpoints.
- Restrict network access to these endpoints where possible, although the vulnerabilities are described as affecting an "unauthenticated user."
## Detection
- Indicators of Compromise: Search application logs for suspicious payloads containing JavaScript elements within HTTP POST requests directed at `/TotalAgility/Kofax/BrowserDevice/ScanFront.aspx` or `/TotalAgility/Kofax/BrowserDevice/ScanFrontDebug.aspx`, especially those attempting to manipulate the specified parameters.
- Detection methods and tools: Web Application Firewalls (WAFs) or Network Intrusion Detection Systems (NIDS) configured with rulesets for detecting XSS injection patterns in POST body data targeting the referenced URL paths.
## References
- Vendor advisories: None explicitly provided, refer to Tungsten Automation support channels.
- Relevant links - defanged:
- hxxps://cert.pl/en/author/cert-polska/
- hxxps://www.cve.org/CVERecord?id=CVE-2024-7874
- hxxps://www.cve.org/CVERecord?id=CVE-2024-7875
- hxxps://cwe.mitre.org/data/definitions/79.html
- hxxps://cert.pl/en/cvd/