CVE-2024-6378: 3DS 3DEXPERIENCE XSS Vulnerability

CVE-2024-6378 Overview

A reflected Cross-site Scripting (XSS) vulnerability has been identified in ENOVIA Collaborative Industry Innovator, a component of Dassault Systèmes' 3DEXPERIENCE platform. This vulnerability affects versions from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x and allows an attacker to execute arbitrary script code within a user's browser session. The attack requires user interaction, where a victim must click a malicious link or visit a compromised page containing the crafted payload.

Critical Impact

Attackers can execute arbitrary JavaScript in authenticated user sessions, potentially leading to session hijacking, credential theft, and unauthorized actions within the 3DEXPERIENCE collaborative platform.

Affected Products

• Dassault Systèmes 3DEXPERIENCE R2022x
• Dassault Systèmes 3DEXPERIENCE R2023x
• Dassault Systèmes 3DEXPERIENCE R2024x

Discovery Timeline

• 2024-08-20 - CVE-2024-6378 published to NVD
• 2024-08-21 - Last updated in NVD database

Technical Details for CVE-2024-6378

Vulnerability Analysis

This reflected XSS vulnerability (CWE-79) occurs in the ENOVIA Collaborative Industry Innovator module of the 3DEXPERIENCE platform. Reflected XSS attacks work by embedding malicious script code in request parameters that are then reflected back in the server's response without proper sanitization or encoding.

In this case, user-supplied input is not adequately validated or encoded before being rendered in the browser context. When a victim clicks a specially crafted URL or submits a form with malicious payload, the server reflects the untrusted input directly into the HTML response. The victim's browser then executes the injected script with the same privileges as the legitimate application.

The vulnerability requires low privileges and user interaction to exploit, but can have significant impact in collaborative enterprise environments where 3DEXPERIENCE is used for product lifecycle management and intellectual property collaboration.

Root Cause

The root cause is improper neutralization of user input in the ENOVIA Collaborative Industry Innovator web interface. The application fails to sanitize or encode special characters in user-controllable input before including it in the HTTP response, allowing attackers to inject executable script content.

Attack Vector

The attack is network-based and requires user interaction. An attacker crafts a malicious URL containing JavaScript payload in vulnerable parameters. The attacker then distributes this URL through phishing emails, social engineering, or by embedding it in other websites. When an authenticated 3DEXPERIENCE user clicks the link, the malicious script executes in their browser session.

A typical attack scenario involves sending a crafted link to a victim user. When clicked, the payload executes JavaScript that can steal session cookies, capture keystrokes, perform actions on behalf of the user, or redirect to credential-harvesting pages. The changed scope (S:C in the CVSS vector) indicates the vulnerability can affect resources beyond the vulnerable component's security scope.

Detection Methods for CVE-2024-6378

Indicators of Compromise

• Unusual URL patterns in web server logs containing JavaScript code or encoded script tags in query parameters
• HTTP requests to 3DEXPERIENCE endpoints with suspicious characters like <script>, javascript:, or encoded equivalents
• User reports of unexpected browser behavior or redirects when accessing 3DEXPERIENCE links
• Authentication anomalies such as session tokens being accessed from unusual IP addresses or locations

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block common XSS payloads in requests to 3DEXPERIENCE endpoints
• Implement Content Security Policy (CSP) headers to prevent inline script execution and report policy violations
• Monitor web server access logs for requests containing suspicious URL-encoded characters or script injection patterns
• Enable browser-side XSS auditors and review any triggered alerts in security monitoring dashboards

Monitoring Recommendations

• Configure SIEM rules to alert on multiple XSS pattern detections targeting 3DEXPERIENCE URLs
• Establish baseline metrics for normal 3DEXPERIENCE user activity and alert on deviations that may indicate compromised sessions
• Monitor for CSP violation reports which may indicate active exploitation attempts
• Review authentication logs for session anomalies following suspected XSS attack patterns

How to Mitigate CVE-2024-6378

Immediate Actions Required

• Consult the 3DS Security Advisory for official patches and update guidance
• Apply the latest security updates to affected 3DEXPERIENCE installations (R2022x through R2024x)
• Implement Content Security Policy headers to restrict script execution sources
• Educate users about the risks of clicking untrusted links to 3DEXPERIENCE resources

Patch Information

Dassault Systèmes has released security updates to address this vulnerability. Organizations should consult the official 3DS vulnerability advisories page for specific patch versions and installation instructions. Apply patches to all affected 3DEXPERIENCE installations spanning R2022x through R2024x releases.

Workarounds

• Deploy a Web Application Firewall (WAF) with XSS detection rules as a compensating control until patches can be applied
• Implement strict Content Security Policy headers to prevent execution of inline scripts
• Configure browser security headers including X-XSS-Protection and X-Content-Type-Options on 3DEXPERIENCE web servers
• Restrict access to 3DEXPERIENCE to trusted network segments using network segmentation controls

# Example Content Security Policy header configuration (Apache)
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'"
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"