CVE-2024-55888: Hush Line XSS Vulnerability

CVE-2024-55888 Overview

CVE-2024-55888 affects Hush Line, an open-source whistleblower management system maintained by Science & Design (scidsg). The production server shipped without a Content Security Policy (CSP) or other browser security headers. This misconfiguration weakens browser-side defenses and can allow attackers to bypass cross-site scripting (XSS) filters. The issue affects versions starting at 0.1.0 and is fixed in version 0.3.5. The weakness is tracked under CWE-1021 (Improper Restriction of Rendered UI Layers or Frames) and was published to NVD on December 12, 2024.

Critical Impact
Missing security headers on a whistleblower platform increase the risk of XSS execution, clickjacking, and disclosure of sensitive source identities through compromised browser sessions.

Affected Products

Hush Line versions 0.1.0 through 0.3.4
scidsg/hushline production server deployments
Self-hosted Hush Line instances prior to the 0.3.5 release

Discovery Timeline

2024-12-12 - CVE-2024-55888 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-55888

Vulnerability Analysis

Hush Line is a Flask-based application used by journalists, security teams, and organizations to receive tips from anonymous sources. The production deployment did not emit a Content Security Policy header, nor headers such as X-Frame-Options, X-Content-Type-Options, Referrer-Policy, or Strict-Transport-Security. Without CSP, the browser has no allowlist defining where scripts, styles, frames, or connections may originate. Any reflected or stored XSS sink in the application can execute attacker-controlled JavaScript with no secondary browser-enforced barrier. The vulnerability requires user interaction, typically clicking a crafted link or visiting a malicious page that frames the Hush Line origin.

Root Cause

The root cause is a deployment-layer configuration omission. The reverse proxy and Flask application did not set response headers that constrain the browser security model. CSP is the principal missing control: it is the modern mechanism that mitigates the impact of injected script by restricting inline execution and external script sources. The absence of X-Frame-Options or a CSP frame-ancestors directive also leaves the application open to UI redress attacks, consistent with the CWE-1021 classification.

Attack Vector

An attacker crafts a payload that triggers an existing XSS sink or embeds the Hush Line interface inside an attacker-controlled frame. Because no CSP is enforced, injected <script> tags or inline event handlers execute in the victim's session context. For a whistleblower platform, the consequence is severe: an attacker who pivots through XSS can exfiltrate draft messages, session cookies, or unmask the user-agent and behavioral fingerprint of an anonymous source. Clickjacking via missing frame-ancestor restrictions can trick authenticated administrators into submitting state-changing requests.

No public proof-of-concept exploit is referenced in the advisory. Technical details are available in the GitHub Security Advisory GHSA-m592-g8qv-hrqx.

Detection Methods for CVE-2024-55888

Indicators of Compromise

HTTP responses from Hush Line endpoints that lack Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options headers
Unexpected outbound requests from authenticated admin browsers to attacker-controlled domains
Anomalous <iframe> embeds of the Hush Line origin in referrer logs

Detection Strategies

Run automated header scanners such as curl -I checks or Mozilla Observatory against the Hush Line origin to confirm CSP presence
Inspect web server and reverse proxy access logs for suspicious query parameters containing script tags, javascript: URIs, or encoded payloads
Correlate browser-side errors and Content Security Policy violation reports once CSP is enabled after patching

Monitoring Recommendations

Alert on Hush Line responses missing a CSP header in continuous compliance scans
Monitor administrator session activity for impossible-travel or new-user-agent events that may follow session theft
Track referrer headers for embedding of Hush Line URLs by unknown third-party domains

How to Mitigate CVE-2024-55888

Immediate Actions Required

Upgrade all Hush Line instances to version 0.3.5 or later
Audit the reverse proxy (nginx, Caddy, or Traefik) configuration to confirm security headers are emitted on every response
Rotate administrator session secrets and force re-authentication after patching
Review recent submissions and admin actions for signs of session abuse during the exposure window

Patch Information

Version 0.3.5 fixes the issue by adding the missing security headers, including a Content Security Policy. Operators should pull the updated container image or source release from the scidsg/hushline GitHub repository and redeploy. Verify the fix by inspecting response headers after upgrade.

Workarounds

Add Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and Referrer-Policy: no-referrer at the reverse proxy layer if immediate upgrade is not possible
Restrict administrative access to the Hush Line interface to a VPN or allowlisted IP range until the patch is applied
Disable embedding of the Hush Line origin in third-party contexts via frame-ancestors 'none'

bash

# Example nginx configuration to enforce security headers
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; frame-ancestors 'none'; base-uri 'self'" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer" always;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;