CVE-2024-37763
Published: 01 July 2024
Summary
CVE-2024-37763 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Machform Machform. Its CVSS base score is 5.4 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
MachForm versions up to 19 contain an unauthenticated stored cross-site scripting vulnerability tracked as CVE-2024-37763 and assigned CWE-79. The flaw resides in the form compilation and results viewing functionality, allowing malicious input to be persisted and later rendered when users with active sessions access the compiled output. It carries a CVSS 3.1 score of 5.4 reflecting network attack vector, low complexity, no required privileges, and required user interaction.
An unauthenticated attacker can supply crafted payloads that are stored by the application and executed in the context of any authenticated user who later views the affected form results. Successful exploitation can modify or disrupt the displayed content, producing limited integrity and availability impacts without exposing sensitive data.
The two reference URLs both point to the same GitHub repository containing disclosure details; no vendor advisory, patch information, or mitigation guidance is supplied in the available data. The associated EPSS score has remained flat at 0.1012 with no observed increase since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-36818
Vulnerability details
MachForm up to version 19 is affected by an unauthenticated stored cross-site scripting which affects users with valid sessions whom can view compiled forms results.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated stored XSS allows injection of JavaScript payloads via form submissions (e.g., text_signature parameters) that execute in browsers of authenticated users viewing/editing results, enabling public-facing app exploitation (T1190), JS execution (T1059.007), browser session hijacking (T1185), and web session cookie theft (T1539).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.