CVE-2024-0981: Okta Browser Plugin XSS Vulnerability

CVE-2024-0981 Overview

CVE-2024-0981 is a Cross-Site Scripting (XSS) vulnerability affecting Okta Browser Plugin versions 6.5.0 through 6.31.0 across Chrome, Edge, Firefox, and Safari browsers. The vulnerability occurs when the plugin prompts users to save credentials within Okta Personal, where malicious input is not properly escaped before being rendered in the user interface.

Critical Impact

Attackers can inject malicious scripts through the credential save prompt, potentially leading to session hijacking, credential theft, or execution of arbitrary JavaScript in the context of the user's browser session.

Affected Products

• Okta Browser Plugin for Chrome versions 6.5.0 through 6.31.0
• Okta Browser Plugin for Edge versions 6.5.0 through 6.31.0
• Okta Browser Plugin for Firefox versions 6.5.0 through 6.31.0
• Okta Browser Plugin for Safari versions 6.5.0 through 6.31.0

Discovery Timeline

• 2024-07-23 - CVE CVE-2024-0981 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0981

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). The flaw exists in the credential save functionality of the Okta Browser Plugin when Okta Personal is enabled with multi-account view.

When a user visits a website and the plugin detects credentials to save, it presents a prompt to store these credentials in Okta Personal. The vulnerability arises because the fields displayed in this prompt were not properly sanitized or escaped. An attacker could craft malicious input containing JavaScript code that gets executed when the plugin renders the credential save dialog.

Importantly, this vulnerability only affects installations where Okta Personal has been added to the plugin to enable the multi-account view feature. The Workforce Identity Cloud plugin without Okta Personal enabled is not affected by this issue.

Root Cause

The root cause of this vulnerability is improper input sanitization in the credential save prompt functionality. When user-supplied data from web page forms is passed to the browser plugin interface without proper HTML entity encoding or escaping, it creates an XSS attack surface. The fields containing username and potentially other credential-related information were rendered directly into the DOM without neutralizing potentially dangerous characters like <, >, ", and '.

Attack Vector

The attack requires user interaction (network-based with user action required). An attacker would need to craft a malicious web page or manipulate form fields on a legitimate site that the user visits. When the Okta Browser Plugin detects these credentials and prompts the user to save them, the malicious script embedded in the credential fields would execute in the context of the browser plugin.

The attack scenario involves:

1. Attacker crafts a web page with credential fields containing XSS payloads
2. User with vulnerable Okta Browser Plugin (with Okta Personal enabled) visits the page
3. Plugin detects credentials and displays save prompt
4. Malicious script executes when the unsanitized content is rendered
5. Attacker can potentially steal session tokens, redirect users, or perform actions on behalf of the victim

For detailed technical information, refer to the Okta Security Advisory for CVE-2024-0981.

Detection Methods for CVE-2024-0981

Indicators of Compromise

• Unusual JavaScript execution or browser behavior when using the Okta Browser Plugin
• Unexpected network requests originating from the browser plugin context
• Modified or suspicious entries in Okta Personal credential storage
• User reports of unexpected prompts or behavior during credential saving operations

Detection Strategies

• Monitor browser extension version deployments across enterprise endpoints and flag any instances of Okta Browser Plugin versions between 6.5.0 and 6.31.0
• Implement Content Security Policy (CSP) headers on internal applications to help mitigate XSS exploitation attempts
• Review browser extension permissions and audit installed extensions for vulnerable versions
• Deploy endpoint detection solutions capable of monitoring browser extension behavior for anomalous script execution

Monitoring Recommendations

• Enable browser extension management policies to track and report installed extension versions across the organization
• Configure web application firewalls to detect and block common XSS payloads that might target this vulnerability
• Monitor authentication logs in Okta for suspicious session activity that could indicate credential compromise
• Implement centralized logging for browser extension activities where supported

How to Mitigate CVE-2024-0981

Immediate Actions Required

• Update Okta Browser Plugin to version 6.32.0 or later across all browsers (Chrome, Edge, Firefox, Safari)
• Audit all enterprise endpoints to identify and remediate vulnerable plugin versions
• If immediate patching is not possible, consider temporarily disabling Okta Personal multi-account view functionality
• Review Okta Personal stored credentials for any suspicious entries that may indicate prior exploitation

Patch Information

Okta has released version 6.32.0 of the Browser Plugin which implements proper escaping of credential fields, addressing the XSS vulnerability. The fix ensures that user-supplied data is properly sanitized before being rendered in the credential save prompt.

Organizations should update the Okta Browser Plugin through their respective browser extension stores:

• Chrome Web Store
• Microsoft Edge Add-ons
• Firefox Add-ons
• Safari Extensions

For additional details, see the Okta Security Advisory for CVE-2024-0981.

Workarounds

• If Okta Personal is not required, remove it from the plugin configuration to disable multi-account view, which eliminates the vulnerable code path
• Implement strict Content Security Policy headers on internal web applications to provide defense-in-depth against XSS attacks
• Use browser extension management policies to restrict or block vulnerable versions of the Okta Browser Plugin until updates can be applied
• Consider deploying endpoint protection solutions that can detect and block XSS exploitation attempts at the browser level

# Browser extension version verification (example for Chrome on macOS)
# Check installed Okta Browser Plugin version
cat ~/Library/Application\ Support/Google/Chrome/Default/Extensions/*/manifest.json | grep -A2 "Okta"
# Verify version is 6.32.0 or higher