CVE-2024-0720: FactoMineR FactoInvestigate XSS Vulnerability

CVE-2024-0720 Overview

CVE-2024-0720 is a cross-site scripting (XSS) vulnerability in FactoMineR FactoInvestigate versions up to 1.9. The flaw resides in the HTML Report Generator component and allows remote attackers to inject arbitrary script content into generated reports. Exploitation requires user interaction, such as opening a crafted report, and can affect resources beyond the vulnerable component's security scope. The vulnerability was published to the National Vulnerability Database (NVD) on January 19, 2024, and tracked as VulDB entry VDB-251544. According to the disclosure, the vendor was contacted but did not respond, and a public exploit description has been released.

Critical Impact
Attackers can execute arbitrary JavaScript in the context of a victim's browser session when they view a maliciously crafted FactoInvestigate HTML report, enabling session theft, phishing, and content manipulation.

Affected Products

FactoMineR FactoInvestigate versions up to and including 1.9
HTML Report Generator component within FactoInvestigate
R environments distributing the vulnerable FactoInvestigate package

Discovery Timeline

2024-01-19 - CVE-2024-0720 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0720

Vulnerability Analysis

FactoInvestigate is an R package that automatically produces exploratory analysis reports in HTML from Multiple Correspondence Analysis and Principal Component Analysis outputs. The vulnerability [CWE-79] exists because the HTML Report Generator embeds user-influenced content into report output without adequate output encoding or sanitization. When an analyst renders a report from attacker-influenced input data, malicious markup persists in the resulting HTML file.

Any user who later opens the report in a browser executes the injected script under the file or hosting origin. Because reports are frequently shared across teams and hosted internally, the injected payload can reach viewers with elevated trust in the document source.

Root Cause

The root cause is improper neutralization of input during web page generation. The report builder concatenates dataset labels, variable names, or annotation strings directly into HTML templates. Values containing <script> tags, event handlers such as onerror, or javascript: URIs are rendered as active markup rather than inert text.

Attack Vector

Exploitation is remote and requires user interaction. An attacker supplies crafted dataset content, such as a malicious column name or category label, that is processed by FactoInvestigate. When a victim opens the generated HTML report, the browser executes the injected payload. The changed security scope indicates the payload can influence resources beyond the vulnerable component, including any origin hosting the report.

No verified public proof-of-concept code is included in the referenced research; see the GitHub CVE-2024-0720 Research and VulDB #251544 entries for disclosure details.

Detection Methods for CVE-2024-0720

Indicators of Compromise

Generated FactoInvestigate HTML reports containing <script>, onerror=, or javascript: strings inside data labels or captions
Outbound browser requests to unknown domains initiated when opening a FactoInvestigate report
Report files with unexpected external resource references such as remote images or iframes
Dataset input files containing HTML metacharacters in variable names or factor labels

Detection Strategies

Inspect FactoInvestigate report source for inline JavaScript or event-handler attributes that were not authored by the analyst
Scan R input datasets for HTML tags or JavaScript URI schemes prior to report generation
Monitor web proxies for anomalous outbound connections initiated by browsers rendering internally hosted analytical reports
Baseline the size and content structure of legitimate reports and alert on deviations

Monitoring Recommendations

Log which users generate and open FactoInvestigate reports and correlate with dataset provenance
Enable Content Security Policy (CSP) reporting on any web server hosting generated reports to capture blocked script executions
Track installations and versions of the FactoInvestigate R package across analyst workstations
Alert on introduction of new external script sources in reports served from internal report portals

How to Mitigate CVE-2024-0720

Immediate Actions Required

Treat all datasets processed by FactoInvestigate versions 1.9 and earlier as untrusted and sanitize labels, factor names, and annotations before report generation
Restrict who can supply datasets that are rendered into shared HTML reports
Open generated reports only in browser profiles isolated from sensitive corporate sessions until a fixed release is confirmed
Review the GitHub CVE-2024-0720 Research and VulDB CTI ID #251544 advisories for updated remediation guidance

Patch Information

No vendor patch is referenced in the NVD entry. The disclosure notes that the vendor was contacted but did not respond. Monitor the FactoMineR project channels for a fixed release beyond version 1.9 and upgrade as soon as one becomes available.

Workarounds

Pre-process input datasets to strip or HTML-encode characters such as <, >, ", ', and & in variable names and labels
Host generated reports behind a strict Content Security Policy that blocks inline scripts and disallowed external origins
Serve reports from a dedicated origin that does not share cookies with sensitive internal applications
Convert reports to static PDF format before distribution to remove active HTML content

bash

# Configuration example: enforce a restrictive CSP for hosted FactoInvestigate reports
# Apply on the web server delivering the HTML output
add_header Content-Security-Policy "default-src 'self'; script-src 'none'; object-src 'none'; base-uri 'none'; frame-ancestors 'self'";
add_header X-Content-Type-Options "nosniff";
add_header Referrer-Policy "no-referrer";