CVE-2024-29878 Overview
CVE-2024-29878 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in Sapplica Sentrifugo 3.2, an open-source Human Resource Management System. The flaw resides in the description parameter of the /sentrifugo/index.php/sitepreference/add endpoint. An unauthenticated remote attacker can craft a malicious URL that, when opened by an authenticated victim, executes arbitrary JavaScript in the victim's browser session. Successful exploitation enables session token theft, credential harvesting, and unauthorized actions performed under the victim's identity within the Sentrifugo application.
Critical Impact
Attackers can hijack authenticated Sentrifugo sessions and steal sensitive HR data by delivering a crafted URL to a logged-in user.
Affected Products
- Sapplica Sentrifugo 3.2
- Sentrifugo sitepreference/add module
- Deployments exposing Sentrifugo to untrusted networks
Discovery Timeline
- 2024-03-21 - CVE-2024-29878 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-29878
Vulnerability Analysis
The vulnerability is a reflected XSS flaw in Sentrifugo's Site Preference module. The application accepts a description parameter and reflects its value back into the rendered HTML response without adequate output encoding or input sanitization. Because the reflection occurs in an HTML context, attacker-controlled markup and script tags are parsed and executed by the victim's browser.
Exploitation requires user interaction: the victim must click or otherwise load a specially crafted URL while authenticated to Sentrifugo. The scope change in the CVSS vector indicates that the injected script can affect resources beyond the vulnerable component, such as cookies, DOM content, and other application state accessible to the browser.
Root Cause
Sentrifugo 3.2 fails to sanitize or contextually encode user-supplied input passed through the description parameter to /sentrifugo/index.php/sitepreference/add. The application concatenates the untrusted value into an HTML response, allowing injected <script> tags and event handlers to execute. This is a classic instance of CWE-79: Improper Neutralization of Input During Web Page Generation.
Attack Vector
An attacker constructs a URL targeting the vulnerable endpoint with a JavaScript payload embedded in the description parameter. The attacker then delivers this URL through phishing email, chat, or a malicious website. When a Sentrifugo user with an active session loads the URL, the payload executes with the privileges of that session. The attacker can then exfiltrate document.cookie, session identifiers, CSRF tokens, or perform authenticated requests on the victim's behalf. See the INCIBE CERT Notice on Sentrifugo Vulnerabilities for additional advisory context.
Detection Methods for CVE-2024-29878
Indicators of Compromise
- HTTP requests to /sentrifugo/index.php/sitepreference/add containing <script>, onerror=, onload=, or javascript: substrings in the description parameter.
- Referer headers pointing to external or untrusted domains preceding access to Sentrifugo endpoints.
- Unusual outbound requests from client browsers to attacker-controlled domains immediately after Sentrifugo page loads.
- Session tokens observed in URL query strings or in logs of third-party services.
Detection Strategies
- Deploy Web Application Firewall (WAF) rules that inspect query and body parameters for HTML and JavaScript metacharacters on Sentrifugo endpoints.
- Correlate web server access logs with authentication logs to identify sessions that immediately follow suspicious URL access patterns.
- Enable Content Security Policy (CSP) violation reporting to surface script injections that browsers refuse to execute.
Monitoring Recommendations
- Monitor Sentrifugo access logs for encoded XSS payloads such as %3Cscript%3E and %22%3E%3Csvg.
- Alert on POST or GET requests to sitepreference/add originating from unauthenticated or external referrers.
- Track anomalous cookie access patterns and session reuse from geographically inconsistent IP addresses.
How to Mitigate CVE-2024-29878
Immediate Actions Required
- Restrict access to the Sentrifugo /sitepreference/add endpoint to authenticated administrators via network ACLs or reverse-proxy rules.
- Deploy WAF signatures that block XSS payloads targeting the description parameter until a vendor patch is applied.
- Instruct users to avoid clicking Sentrifugo links from untrusted sources and to log out of active sessions when not in use.
- Rotate session secrets and force re-authentication if exploitation is suspected.
Patch Information
No vendor patch is currently referenced in the NVD entry for CVE-2024-29878. Administrators should monitor the Sapplica Sentrifugo project and the INCIBE CERT Notice on Sentrifugo Vulnerabilities for updates. Until a fix is released, apply the compensating controls listed below.
Workarounds
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
- Set the HttpOnly and Secure flags on all Sentrifugo session cookies to reduce the impact of script-based cookie theft.
- Place Sentrifugo behind an authenticating reverse proxy that filters requests containing HTML control characters in the description parameter.
- Segment Sentrifugo deployments from general user networks and require VPN access to reach the application.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.