CVE-2024-1143 Overview
CVE-2024-1143 is a Cross-Site Scripting (XSS) vulnerability affecting LINE Corporation's Central Dogma, a highly-available service configuration repository. Versions prior to 0.64.1 improperly handle user-supplied input rendered in the web interface. An attacker can inject malicious client-side script that executes in the context of an authenticated user's browser session. Successful exploitation leaks session tokens, enabling authentication bypass and unauthorized access to configuration data managed through the platform. The vulnerability is tracked under [CWE-79] and requires user interaction to trigger.
Critical Impact
Attackers can steal authenticated user sessions and bypass authentication controls to access Central Dogma repositories.
Affected Products
- LINE Corporation Central Dogma versions prior to 0.64.1
- Deployments exposing the Central Dogma web administration interface
- Environments where users authenticate through the Central Dogma UI
Discovery Timeline
- 2024-02-02 - CVE-2024-1143 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-1143
Vulnerability Analysis
Central Dogma is a version-controlled service configuration repository developed by LINE Corporation. The flaw resides in the web UI layer, which renders user-controlled input without adequate output encoding or sanitization. An attacker crafts a payload containing JavaScript and delivers it through an input surface reflected or stored within the application.
When a victim loads the affected view, the browser parses the injected markup and executes attacker-controlled script within the same origin as Central Dogma. The script accesses browser storage and cookies associated with the session. Because the compromised script runs with the victim's privileges, the attacker gains equivalent access to configuration repositories after exfiltrating the session credential.
Root Cause
The root cause is insufficient neutralization of input during web page generation, classified as [CWE-79]. Central Dogma's rendering path fails to encode special characters such as <, >, and quotation marks before inserting user data into HTML contexts. This allows attacker-supplied content to break out of intended data contexts and execute as script.
Attack Vector
Exploitation occurs over the network and requires user interaction. An attacker delivers a crafted URL or persists a malicious payload inside a Central Dogma resource. When an authenticated administrator or user views the affected page, the injected script executes in their browser, harvests session data, and transmits it to an attacker-controlled endpoint. The scope change indicates that the impact extends beyond the vulnerable component to other browser contexts.
Review the LINE Central Dogma Security Advisory GHSA-34q3-p352-c7q8 for vendor-supplied technical details.
Detection Methods for CVE-2024-1143
Indicators of Compromise
- Unexpected <script> tags, event handlers, or JavaScript URIs stored in Central Dogma project names, repository entries, or file content
- Outbound HTTP requests from user browsers to unknown domains immediately after loading Central Dogma pages
- Session tokens observed in use from unusual IP addresses or geographies shortly after a user accesses the application
Detection Strategies
- Inspect Central Dogma access logs for requests containing URL-encoded payloads such as %3Cscript%3E, onerror=, or javascript:
- Review stored repository content for HTML or script fragments that should not appear in configuration data
- Correlate authentication events with session-cookie reuse across distinct source addresses to identify hijacked sessions
Monitoring Recommendations
- Enable Content Security Policy (CSP) violation reporting to surface script execution attempts blocked by policy
- Forward Central Dogma web server and application logs to a centralized analytics platform for retention and query
- Monitor for anomalous administrative actions performed through the Central Dogma API following UI interactions
How to Mitigate CVE-2024-1143
Immediate Actions Required
- Upgrade Central Dogma to version 0.64.1 or later as published in the vendor security advisory
- Invalidate active user sessions and require reauthentication after applying the patch
- Audit repositories for any content injected while the vulnerable version was in service
Patch Information
LINE Corporation addressed the vulnerability in Central Dogma release 0.64.1. Details are available in the GitHub Security Advisory GHSA-34q3-p352-c7q8. Apply the upgrade following standard change control procedures and verify the running version after deployment.
Workarounds
- Restrict access to the Central Dogma web interface to trusted networks using firewall or reverse-proxy controls until patching completes
- Deploy a Content Security Policy that disallows inline scripts and limits script sources to trusted origins
- Enforce short session lifetimes and require reauthentication for sensitive operations to reduce the value of stolen tokens
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
