CVE-2022-34009

What it actually does

XSS payload stored in a ticket's temporary file is removed by Windows Defender malware detection, after which Fossil fails to handle the missing file and crashes the daemon, resulting in denial of service.

Why it matters to the business

Windows-hosted Fossil instances experience repeated service outages that interrupt version control and ticket workflows, with elevated urgency due to public exploit availability more than four years after disclosure and no listed fixed versions.

How an attack unfolds

An attacker submits a crafted XSS payload through a ticket; Windows Defender quarantines or deletes the associated temporary file; Fossil's subsequent attempt to read the absent file triggers an unhandled error that terminates the daemon process.

How to fix it

Upgrade to a version that gracefully handles missing temporary ticket files; on Windows deployments, configure Windows Defender exclusions only for Fossil temporary directories after risk assessment or migrate Fossil to non-Windows platforms until a fixed release is available.

How to confirm the fix worked

Confirm that Fossil no longer terminates when a ticket temporary file is absent; test by manually deleting the file during active ticket operations and verifying daemon stability; monitor process exit codes and logs for file-not-found errors related to ticket storage.

Typical attack path

1. Identify a publicly reachable Fossil instance on Windows
2. Submit ticket content containing an XSS payload that triggers Windows Defender
3. Observe removal of the temporary ticket file
4. Trigger Fossil daemon operations that reference the missing file to induce crash

How to detect it

Search Fossil and Windows event logs for repeated daemon crashes immediately following ticket submissions; look for file-access errors referencing temporary ticket paths and correlate with Windows Defender quarantine events.

What your security team should do

• Prioritize migration of Fossil instances off Windows or apply custom error-handling patches
• Implement file-integrity monitoring on ticket temporary directories
• Review and harden Windows Defender policies around Fossil data paths
• Establish monitoring for unexpected Fossil daemon restarts