Another Redis Desktop Manager: Local code execution via XSS (CVE-2024-23998)

CVE-2024-23998 describes a vulnerability in Another Redis Desktop Manager (<= 1.6.6) where improper sanitization of the 'font_faq' configuration string allows for Cross-Site Scripting (XSS). Because the application leverages the 'v-html' directive and enables 'nodeIntegration' within its Electron framework, an attacker who successfully injects malicious JavaScript into the application's resources - such as by distributing a trojanized installer or modifying the application's configuration files - can achieve Remote Code Execution (RCE) with the privileges of the application when the user interacts with the affected UI element.

Attack Chain

1. Attacker obtains the distribution files for Another Redis Desktop Manager.
2. Attacker modifies the 'en.js' file within the application resources to inject malicious JavaScript into the 'font_faq' string.
3. Attacker repackages the application into a trojanized installer.
4. User installs the malicious software (often bypassing security warnings).
5. User launches the application and navigates to the Settings menu.
6. User hovers the mouse cursor over the Font Family help icon.
7. The application renders the 'font_faq' string via 'v-html', executing the injected JavaScript.
8. The malicious script uses the enabled 'nodeIntegration' to execute arbitrary operating system commands, such as 'calc.exe'.

Impact

Successful exploitation allows for arbitrary code execution on the host machine running Another Redis Desktop Manager. The severity is high (CVSS 9.6) as it permits full system compromise, data exfiltration, or persistence depending on the attacker's payload.

Recommendation

• Inventory all installations of Another Redis Desktop Manager and ensure they are upgraded to a version later than 1.6.6.
• Implement strict application control policies to prevent the execution of unauthorized or tampered binaries, specifically targeting the installation directory of Electron-based applications.
• Utilize endpoint security tools to monitor for unexpected process-spawning behavior from 'electron.exe' or the main application process.