CVE-2024-29879: Sapplica Sentrifugo XSS Vulnerability

CVE-2024-29879 Overview

CVE-2024-29879 is a reflected Cross-Site Scripting (XSS) vulnerability in Sapplica Sentrifugo 3.2, an open-source human resources management application. The flaw resides in the /sentrifugo/index.php/index/getdepartments/format/html endpoint and stems from improper sanitization of the business_id parameter. A remote attacker can craft a malicious URL that, when visited by an authenticated victim, executes arbitrary JavaScript in the victim's browser session. Successful exploitation can lead to session data theft, credential harvesting, and unauthorized actions performed on behalf of the victim within the Sentrifugo application.

Critical Impact
Attackers can hijack authenticated sessions and steal sensitive HR data by luring users to a specially crafted URL targeting the vulnerable business_id parameter.

Affected Products

Sapplica Sentrifugo 3.2
Deployments exposing the /sentrifugo/index.php/index/getdepartments/format/html endpoint
HR environments running unpatched Sentrifugo instances

Discovery Timeline

2024-03-21 - CVE-2024-29879 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29879

Vulnerability Analysis

The vulnerability is a reflected XSS flaw classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). Sentrifugo 3.2 accepts user-supplied input in the business_id parameter and reflects it into the HTML response without adequate encoding or sanitization. An attacker who can convince an authenticated Sentrifugo user to click a crafted link can execute arbitrary JavaScript in the context of that user's session. Because Sentrifugo manages employee, payroll, and organizational data, session hijacking can expose sensitive personally identifiable information (PII) and enable further internal attacks.

Root Cause

The root cause is missing output encoding in the getdepartments action handler. The business_id query parameter is passed into the HTML rendering pipeline without contextual escaping. As a result, script payloads embedded in the parameter are rendered as executable content by the victim's browser rather than being treated as inert text.

Attack Vector

Exploitation requires user interaction. An attacker crafts a URL of the form /sentrifugo/index.php/index/getdepartments/format/html?business_id=<payload> and delivers it through phishing, chat, or a malicious referrer. When an authenticated user opens the link, the injected script runs with the privileges of the victim's session, allowing theft of session cookies, CSRF token exfiltration, and manipulation of the Sentrifugo interface. No authentication is required from the attacker to construct the payload, but the victim must be logged in for session theft to succeed. Refer to the INCIBE Security Notice on Vulnerabilities for additional technical context.

Detection Methods for CVE-2024-29879

Indicators of Compromise

HTTP requests to /sentrifugo/index.php/index/getdepartments/format/html containing <script>, onerror=, onload=, or URL-encoded equivalents in the business_id parameter
Unusual outbound requests from user browsers to attacker-controlled domains shortly after accessing Sentrifugo
Session cookies appearing in web server referrer logs or external analytics platforms
Abnormal spikes in traffic to the getdepartments endpoint from a single referrer

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the business_id parameter for HTML tags, JavaScript event handlers, and encoded script markers
Enable verbose HTTP access logging on the Sentrifugo web server and alert on query strings containing common XSS payload patterns
Review browser Content Security Policy (CSP) violation reports for inline script executions originating from Sentrifugo pages

Monitoring Recommendations

Continuously monitor authentication and session activity in Sentrifugo for concurrent logins from geographically distant IPs
Correlate WAF alerts with endpoint telemetry to identify users who clicked malicious links
Track EPSS scoring for CVE-2024-29879 to prioritize response as exploitation likelihood shifts over time

How to Mitigate CVE-2024-29879

Immediate Actions Required

Restrict access to the Sentrifugo application to trusted networks or VPN users until a patched build is deployed
Deploy WAF signatures that block reflected XSS payloads targeting the business_id parameter
Notify Sentrifugo users of active phishing risk and instruct them to avoid clicking Sentrifugo links from untrusted sources
Rotate active session tokens and force re-authentication if suspicious activity is observed

Patch Information

At the time of publication, no vendor advisory or fixed release is listed in the NVD entry for Sapplica Sentrifugo 3.2. Administrators should monitor the INCIBE Security Notice on Vulnerabilities and the Sapplica project channels for updated builds. Until a patched version is available, apply the workarounds below.

Workarounds

Implement a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins
Add a reverse-proxy filter that URL-decodes and rejects requests where business_id contains angle brackets, quotes, or javascript: schemes
Enable the HttpOnly and Secure flags on Sentrifugo session cookies to limit the impact of script-based cookie theft
Disable or restrict the /sentrifugo/index.php/index/getdepartments/format/html endpoint at the web server layer if it is not required for business operations

bash

# Example Nginx rule to block XSS payloads in the business_id parameter
location /sentrifugo/index.php/index/getdepartments/ {
    if ($arg_business_id ~* "(<|>|script|onerror|onload|javascript:)") {
        return 403;
    }
    proxy_pass http://sentrifugo_backend;
}