CVE-2024-47925: TCExam XSS Vulnerability

CVE-2024-47925 Overview

CVE-2024-47925 is a cross-site scripting (XSS) vulnerability affecting Tecnick TCExam, an open-source computer-based assessment platform. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Multiple injection points in the application accept attacker-controlled data that is rendered back to users without adequate sanitization or output encoding. An unauthenticated remote attacker can craft malicious payloads that execute arbitrary JavaScript in the browser of any user who interacts with a tainted page or link.

Critical Impact

Successful exploitation allows attackers to steal session cookies, exfiltrate exam data, hijack administrator accounts, and manipulate assessment content rendered to victims.

Affected Products

• Tecnick TCExam (multiple versions)
• Web-based assessment deployments exposing TCExam to untrusted networks
• TCExam instances accessible by examinees, instructors, or administrators

Discovery Timeline

• 2024-12-30 - CVE-2024-47925 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-47925

Vulnerability Analysis

The vulnerability resides in multiple TCExam components that accept user-controllable input and emit it back into HTML responses. The application fails to apply context-aware output encoding before rendering parameters in the response body. This allows attackers to inject HTML and JavaScript that browsers parse and execute under the application's origin. The flaw is exploitable over the network without authentication or user privileges. Successful exploitation produces a confidentiality impact, enabling theft of session tokens, examinee answers, and credentials supplied within the authenticated session.

Root Cause

The root cause is improper neutralization of input during web page generation, classified as [CWE-79]. Affected request handlers concatenate parameter values into HTML output without escaping characters such as <, >, ", and '. The application also lacks a strict Content Security Policy that would limit the impact of injected scripts. Because multiple endpoints share this pattern, the vulnerability is not isolated to a single field or page.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker crafts a malicious URL or form submission carrying a JavaScript payload in a vulnerable parameter. The attacker delivers the URL to a victim through phishing, forum posts, or instant messaging. When the victim loads the link in an authenticated TCExam session, the injected script executes in the victim's browser context. The script can then issue authenticated requests, read DOM content, and exfiltrate cookies that are not flagged HttpOnly. See the Israeli Government CVE Advisories for additional context.

Detection Methods for CVE-2024-47925

Indicators of Compromise

• HTTP requests to TCExam endpoints containing encoded <script>, onerror=, onload=, or javascript: substrings in query parameters or POST bodies
• Unexpected outbound connections from user browsers to attacker-controlled domains following TCExam page loads
• Session cookies for TCExam appearing in referer headers or external logs
• Abnormal administrator activity originating from examinee IP addresses or unusual user agents

Detection Strategies

• Inspect web server access logs for TCExam request parameters containing HTML or JavaScript metacharacters
• Deploy a web application firewall (WAF) rule set that flags reflected XSS payload patterns against TCExam URLs
• Monitor browser console errors and CSP violation reports from TCExam users where available
• Correlate authentication events with referer headers to identify session use following click-through from external links

Monitoring Recommendations

• Enable verbose HTTP request logging on the TCExam web server and forward logs to a centralized analytics platform
• Alert on TCExam administrative actions performed outside of expected business hours or source networks
• Track failed and successful logins per source IP to detect session reuse following cookie theft

How to Mitigate CVE-2024-47925

Immediate Actions Required

• Restrict TCExam access to trusted networks or place the application behind a VPN until a fix is applied
• Deploy WAF rules that block requests containing common XSS payload signatures targeting TCExam endpoints
• Set the HttpOnly and Secure flags on all TCExam session cookies to limit script-based theft
• Invalidate active TCExam sessions and force password resets for administrator accounts

Patch Information

No vendor patch reference is included in the NVD record at the time of publication. Administrators should consult the Israeli Government CVE Advisories and the Tecnick TCExam project repository for the latest fixed release and apply updates as soon as they become available.

Workarounds

• Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to the TCExam origin
• Add reverse-proxy filters that reject requests containing <, >, or script tokens in query string parameters not requiring HTML input
• Require multi-factor authentication for administrator accounts to reduce the impact of stolen session tokens
• Educate examinees and instructors to avoid clicking TCExam links received from untrusted sources

# Example NGINX configuration adding a restrictive CSP and secure cookie attributes
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
proxy_cookie_path / "/; HttpOnly; Secure; SameSite=Strict";