CVE-2024-12641: Cht Tenderdoctransfer RCE Vulnerability

CVE-2024-12641 Overview

CVE-2024-12641 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting TenderDocTransfer, a document transfer application developed by Chunghwa Telecom (CHT). The application establishes a local web server and exposes APIs for communication with target websites. Due to the absence of Cross-Site Request Forgery (CSRF) protection on these APIs, unauthenticated remote attackers can leverage phishing techniques to execute arbitrary JavaScript code within a victim's browser. The severity is compounded by the fact that the local web server supports Node.js features, enabling attackers to escalate from XSS to full operating system command execution.

Critical Impact

This vulnerability chains Reflected XSS with missing CSRF protections and Node.js capabilities to enable remote attackers to execute arbitrary OS commands on victim systems through phishing attacks.

Affected Products

• CHT TenderDocTransfer (all versions)

Discovery Timeline

• 2024-12-16 - CVE-2024-12641 published to NVD
• 2025-12-23 - Last updated in NVD database

Technical Details for CVE-2024-12641

Vulnerability Analysis

The TenderDocTransfer application implements a lightweight local web server architecture designed to facilitate document transfer operations between the client system and remote websites. This architectural choice introduces significant security risks when the exposed API endpoints lack proper security controls.

The vulnerability stems from two compounding security weaknesses. First, the API endpoints exposed by the local web server do not implement CSRF token validation, allowing malicious websites to make unauthorized requests on behalf of authenticated users. Second, these APIs are susceptible to Reflected XSS, meaning user-supplied input is echoed back in responses without proper sanitization or encoding.

The Node.js runtime environment powering the local web server provides access to system-level functionality through modules like child_process. When an attacker successfully executes JavaScript in this context, they can leverage these Node.js capabilities to spawn shell processes and execute arbitrary operating system commands with the privileges of the user running the application.

Root Cause

The root cause is a combination of missing input validation on API parameters and absent CSRF protection mechanisms. The application fails to sanitize user-controllable input before reflecting it in HTTP responses, and does not validate the origin of incoming API requests. This allows cross-origin requests from malicious sites to interact with the local server's APIs without restriction.

Attack Vector

The attack requires user interaction, typically through a phishing vector. An attacker crafts a malicious webpage containing specially constructed requests to the victim's locally-running TenderDocTransfer web server. When the victim visits the attacker-controlled page (often via a phishing link), the malicious JavaScript executes API calls to localhost where TenderDocTransfer is running. Due to missing CSRF protections, these requests are accepted. The reflected XSS payload then executes within the Node.js context, allowing the attacker to invoke system commands through Node.js APIs.

The attack chain proceeds as follows: the victim clicks a phishing link leading to an attacker-controlled webpage. The malicious page sends crafted requests to the local TenderDocTransfer API endpoints. The lack of CSRF validation allows these cross-origin requests to succeed. The XSS payload reflects back and executes in the Node.js context. The attacker leverages Node.js system access to execute arbitrary OS commands.

Detection Methods for CVE-2024-12641

Indicators of Compromise

• Unexpected outbound connections from the TenderDocTransfer process to external hosts
• Unusual child process spawning from the TenderDocTransfer application or its Node.js runtime
• JavaScript errors or suspicious code execution in browser developer console when visiting untrusted sites
• Log entries showing API requests with encoded JavaScript payloads or unusual characters

Detection Strategies

• Monitor for anomalous network traffic patterns from localhost-bound services attempting external communications
• Implement endpoint detection rules for Node.js processes spawning shell commands or system utilities
• Deploy browser-based security controls that detect and block cross-origin requests to localhost services
• Review web server access logs for API requests containing suspicious JavaScript-like content or encoded payloads

Monitoring Recommendations

• Enable verbose logging on TenderDocTransfer if available to capture all API request details
• Deploy endpoint detection and response (EDR) solutions to monitor for command execution chains
• Implement network segmentation to limit the exposure of locally-running services
• Use SentinelOne's behavioral AI to detect anomalous process trees originating from document transfer applications

How to Mitigate CVE-2024-12641

Immediate Actions Required

• Discontinue use of TenderDocTransfer until a patched version is available from Chunghwa Telecom
• Implement network-level restrictions to block unauthorized access to the local web server ports
• Educate users about phishing risks and the dangers of clicking untrusted links while TenderDocTransfer is running
• Consider using application whitelisting to prevent unauthorized process execution

Patch Information

Users should consult the Taiwan CERT Security Advisory for the latest information on patches and remediation guidance from Chunghwa Telecom. Monitor vendor communications for security updates addressing this vulnerability.

Workarounds

• Disable or uninstall TenderDocTransfer when not actively in use for document transfer operations
• Use browser extensions that block cross-origin requests to localhost addresses
• Implement host-based firewall rules to restrict which processes can bind to local ports
• Consider running TenderDocTransfer in an isolated virtual environment to contain potential exploitation

If firewall restrictions are implemented, ensure rules block inbound connections from external sources to the local web server port used by TenderDocTransfer. Additionally, consider implementing egress filtering to prevent any unauthorized outbound communications from the application process.