CVE-2024-12641
Published: 16 December 2024
Summary
CVE-2024-12641 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Cht Tenderdoctransfer. Its CVSS base score is 9.6 (Critical).
Operationally, ranked in the top 2.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
TenderDocTransfer, a product from Chunghwa Telecom, contains a reflected cross-site scripting vulnerability (CWE-79) that stems from missing CSRF protection on the APIs exposed by its locally installed web server. The application uses this server to facilitate communication with a target website and includes Node.js features, allowing script execution to extend beyond the browser.
Unauthenticated remote attackers can exploit the flaw through phishing attacks that invoke specific APIs, causing arbitrary JavaScript to run in the victim's browser context. Because the server supports Node.js, successful exploitation enables attackers to execute operating-system commands, resulting in full confidentiality, integrity, and availability impact as reflected in the CVSS 9.6 score.
Advisories published by Taiwan's CERT at the referenced URLs detail the vulnerability and recommend applying vendor updates or mitigations once available. The associated EPSS score has remained flat at 0.3569 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51016
Vulnerability details
TenderDocTransfer from Chunghwa Telecom has a Reflected Cross-site scripting vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthenticated remote…
more
attackers could use specific APIs through phishing to execute arbitrary JavaScript code in the user’s browser. Since the web server set by the application supports Node.Js features, attackers can further leverage this to run OS commands.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.