CVE-2024-39125

What it actually does

Cross-site scripting flaw permits arbitrary script execution in a victim's browser when a malicious SCRIPT element is supplied inside an untrusted HTTP Referer header that Roundup renders without sufficient sanitization.

Why it matters to the business

Attackers could hijack user sessions, steal sensitive issue-tracking data, or perform unauthorized actions on behalf of authenticated users, leading to data leakage and loss of trust in the tracking system.

How an attack unfolds

An attacker crafts a link or page whose Referer header contains a SCRIPT tag, lures an authenticated Roundup user to that resource, and the application echoes the header into HTML, causing the script to run in the user's context.

How to fix it

Upgrade Roundup to version 2.4.0 or later where the Referer header is properly sanitized before output; until then, deploy a web application firewall rule that strips or blocks SCRIPT content from Referer headers and monitor for unusual Referer values.

How to confirm the fix worked

Confirm the installed Roundup version is at least 2.4.0; test by sending a request with a Referer header containing a benign script tag and verify the tag is escaped or removed in the response; review release notes for the XSS fix.

Typical attack path

1. Attacker prepares a malicious Referer header containing executable script
2. Victim authenticated to Roundup is induced to trigger a request that includes the crafted Referer
3. Roundup includes the Referer value in rendered output without proper encoding
4. Browser executes the injected script under the application's origin
5. Script performs actions such as stealing cookies, submitting forms, or exfiltrating data

How to detect it

Search web server and application logs for HTTP requests whose Referer header contains script, iframe, or other active HTML tags; correlate with authenticated Roundup sessions and look for unexpected post-authentication behavior or data access patterns.

• Referer:.*<script
• Referer:.*javascript:
• Referer:.*onerror=
• Referer:.*onload=

What your security team should do

• Immediately upgrade all Roundup instances to 2.4.0 or newer
• Add WAF filtering to neutralize script content in Referer headers as a compensating control
• Audit application logs for Referer values containing HTML tags
• Educate users about avoiding untrusted links while logged into the tracker