CVE-2024-26140: Yetanalytics LRS XSS Vulnerability

CVE-2024-26140 Overview

CVE-2024-26140 is a stored Cross-Site Scripting (XSS) vulnerability in the Yet Analytics Core LRS Library (com.yetanalytics/lrs) and SQL LRS (lrsql). The flaw resides in the Learning Record Store (LRS) Statement Browser, which fails to sanitize values rendered from xAPI statements. An attacker who can submit a maliciously crafted xAPI statement can inject script or arbitrary HTML tags that execute when a user views the statement in the browser interface. The issue is tracked under [CWE-79] and affects com.yetanalytics/lrs prior to 1.2.17 and SQL LRS prior to 0.7.5.

Critical Impact
A crafted xAPI statement can execute JavaScript in the context of any user viewing the LRS Statement Browser, enabling session theft and unauthorized actions against the LRS.

Affected Products

com.yetanalytics/lrs versions prior to 1.2.17
Yet Analytics SQL LRS (lrsql) versions prior to 0.7.5
Deployments exposing the LRS Statement Browser to untrusted xAPI submitters

Discovery Timeline

2024-02-20 - CVE-2024-26140 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-26140

Vulnerability Analysis

The LRS Statement Browser renders stored xAPI statements as HTML for administrative review. Values extracted from statement fields are passed into the Hiccup templating library without output encoding. Because hiccup version 1.0.5 returns raw strings by default, attacker-supplied content in a statement is emitted as live markup. When an authenticated LRS operator opens the browser view, injected <script> tags or event-handler attributes execute in their session context.

The scope is marked as changed because the injected script executes in the LRS web origin even though the payload originates from a separate xAPI ingestion channel. Exploitation requires the victim to load the affected view (user interaction), but no authentication is required to submit the poisoned statement to a permissive LRS endpoint.

Root Cause

The root cause is missing output sanitization in com.yetanalytics.lrs.pedestal.routes.statements.html. The namespace used hiccup.core, which does not auto-escape strings. Statement values were interpolated directly into HTML without HTML entity encoding, allowing attacker markup to break out of the intended text context.

Attack Vector

An attacker with the ability to POST an xAPI statement to the LRS injects HTML or JavaScript into a statement field such as actor.name, verb.display, or object.definition.name. When an LRS administrator later opens the Statement Browser, the browser parses the payload as executable markup. Consequences include session cookie theft, forced administrative actions, and pivoting to other resources accessible from the LRS origin.

clojure

; Patch: src/main/com/yetanalytics/lrs/pedestal/routes/statements/html.cljc
(ns com.yetanalytics.lrs.pedestal.routes.statements.html
-  (:require #?@(:clj [[hiccup.core :as html]
+  (:require #?@(:clj [[hiccup2.core :as html]
                       [clojure.java.io :as io]]
                 :cljs [[hiccups.runtime :as hic]
                        [goog.string :refer [format]]

Source: GitHub Commit d7f4883

The fix migrates to hiccup2.core, which auto-escapes string content by default, and upgrades the dependency to hiccup/hiccup 2.0.0-RC3 in deps.edn.

Detection Methods for CVE-2024-26140

Indicators of Compromise

xAPI statement fields containing HTML tags such as <script>, <img onerror=, or <svg onload= in actor, verb, or object properties.
Statement Browser responses containing unescaped angle brackets in value contexts.
Outbound requests from LRS administrator browsers to unfamiliar domains shortly after opening the Statement Browser.

Detection Strategies

Inspect stored statements in the LRS database for payloads matching common XSS patterns before they are rendered.
Enable Content Security Policy (CSP) reporting on the LRS web front end and review script-src violation reports.
Correlate xAPI ingestion source IPs with subsequent anomalous administrator session activity.

Monitoring Recommendations

Log all xAPI PUT and POST statement submissions with source identity and payload hash for retrospective review.
Monitor for LRS administrator sessions issuing unexpected API calls immediately after statement browsing.
Track running versions of com.yetanalytics/lrs and lrsql across deployments to identify unpatched instances.

How to Mitigate CVE-2024-26140

Immediate Actions Required

Upgrade com.yetanalytics/lrs to version 1.2.17 or later.
Upgrade SQL LRS (lrsql) to version 0.7.5 or later.
Audit existing stored xAPI statements for injected markup and purge or quarantine suspicious records before reopening the Statement Browser.
Restrict xAPI statement submission to authenticated, trusted sources where feasible.

Patch Information

The fix is delivered in GitHub Release v1.2.17 and GitHub Release v0.7.5. See the GitHub Security Advisory GHSA-7rw2-3hhp-rc46 and the Clojars Version Release for artifact details. The patch replaces hiccup.core with the auto-escaping hiccup2.core API.

Workarounds

No vendor workaround exists; upgrading to the patched versions is required.
As a compensating control, deploy a strict Content Security Policy that disallows inline scripts on the LRS Statement Browser origin.
Limit administrator access to the Statement Browser to trusted networks until patching is complete.

bash

# Update dependency in deps.edn to the patched library version
# com.yetanalytics/lrs {:mvn/version "1.2.17"}
clj -Stree | grep com.yetanalytics/lrs

# For SQL LRS deployments, pull the patched release
docker pull yetanalytics/lrsql:v0.7.5