CVE-2024-30878: Rageframe RageFrame XSS Vulnerability

CVE-2024-30878 Overview

CVE-2024-30878 is a reflected cross-site scripting (XSS) vulnerability in RageFrame2 version 2.6.43. The flaw resides in the handling of the upload_drive parameter, which fails to sanitize user-supplied input before rendering it in the browser context. Remote attackers can inject arbitrary HTML or JavaScript by crafting a malicious payload and convincing a victim to interact with the URL. Successful exploitation allows script execution in the victim's browser session, potentially leading to session token theft, credential harvesting, or unauthorized actions within the application.

Critical Impact

Remote attackers can execute arbitrary scripts in a victim's browser and obtain sensitive information through a crafted upload_drive parameter payload.

Affected Products

• RageFrame2 v2.6.43
• Component: upload_drive parameter handler
• Deployments running the affected release without input sanitization patches

Discovery Timeline

• 2024-04-11 - CVE-2024-30878 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30878

Vulnerability Analysis

RageFrame2 is a PHP-based rapid development framework built on Yii2. The application accepts the upload_drive parameter and echoes its value back to the client without applying output encoding or input validation. This condition creates a reflected XSS sink categorized under [CWE-94] Improper Control of Generation of Code.

An attacker crafts a URL containing JavaScript inside the upload_drive value. When a victim loads the URL while authenticated to the RageFrame2 backend, the injected code runs under the origin of the vulnerable application. The attacker can then read cookies accessible to JavaScript, exfiltrate CSRF tokens, or invoke authenticated API endpoints on behalf of the user.

Root Cause

The vulnerability stems from the absence of context-aware output encoding when the upload_drive request parameter is reflected in the server response. The framework trusts the parameter's contents and inserts them directly into HTML output. See the GitHub Issue Discussion for community reporting on the input handling defect.

Attack Vector

Exploitation requires user interaction. An attacker delivers the malicious link through phishing, chat, or an embedded reference on an attacker-controlled page. The victim must have an active session with the RageFrame2 application for the payload to yield authenticated impact. Because the attack occurs over the network with no privileges required, it is well suited to broad social engineering campaigns targeting administrators of RageFrame2 deployments.

Refer to the RageFrame2 issue tracker for community discussion of the affected parameter behavior.

Detection Methods for CVE-2024-30878

Indicators of Compromise

• Web server access logs containing the upload_drive parameter with HTML tags, javascript: URIs, or event handlers such as onerror= and onload=
• Requests with URL-encoded script sequences (%3Cscript%3E, %3Cimg) targeting RageFrame2 endpoints
• Outbound requests from user browsers to unfamiliar domains immediately following interaction with RageFrame2 URLs

Detection Strategies

• Deploy web application firewall (WAF) rules that inspect the upload_drive parameter for script tags, event handlers, and encoded payload variants
• Correlate anomalous administrator session activity, such as unexpected privilege changes, with prior requests carrying suspicious query parameters
• Review browser Content Security Policy (CSP) violation reports for blocked inline script execution originating from RageFrame2 pages

Monitoring Recommendations

• Enable verbose HTTP request logging on reverse proxies fronting RageFrame2 instances
• Alert on repeated 200-status responses containing reflected user input in the response body
• Track outbound HTTP requests from administrator workstations to non-corporate domains during RageFrame2 sessions

How to Mitigate CVE-2024-30878

Immediate Actions Required

• Restrict access to the RageFrame2 administrative interface to trusted networks using IP allow lists or VPN gateways
• Instruct administrators to avoid clicking unverified links pointing to the RageFrame2 application
• Deploy WAF signatures that block script injection attempts against the upload_drive parameter
• Rotate administrative session cookies and CSRF tokens if suspicious activity is observed

Patch Information

No vendor advisory or fixed release is referenced in the NVD entry for CVE-2024-30878. Monitor the RageFrame2 GitHub repository for upstream fixes and apply the patch immediately once available. Until a patch ships, implement compensating controls at the application gateway and browser layer.

Workarounds

• Add server-side validation that rejects upload_drive values containing HTML control characters (<, >, ", ')
• Apply context-aware output encoding on any template that renders upload_drive content
• Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
• Enable the HttpOnly and Secure flags on session cookies to limit the impact of successful script execution

# Example nginx rule to block script payloads in the upload_drive parameter
if ($args ~* "upload_drive=[^&]*(<script|javascript:|onerror=|onload=)") {
    return 403;
}

# Example Content-Security-Policy header
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';" always;