Vulnerability · Published Dec 16, 2024 · Assigned by twcert

CVE-2024-12641Chunghwa Telecom TenderDocTransfer - Reflected Cross-site Scripting to RCE

Critical 9.6

In plain English

A critical-severity cross-site scripting in TenderDocTransfer from Chunghwa Telecom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.6Critical

Exploit odds (30 days)1.4%top 26.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

TenderDocTransfer from Chunghwa Telecom has a Reflected Cross-site scripting vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthenticated remote attackers could use specific APIs through phishing to execute arbitrary JavaScript code in the user’s browser. Since the web server set by the application supports Node.Js features, attackers can further leverage this to run OS commands.

Affected products (as reported)

Vendor	Product	Versions
Chunghwa Telecom	TenderDocTransfer	0.41.151 – through 0.41.156

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

https://www.twcert.org.tw/tw/cp-132-8292-4fd98-1.html third-party-advisory
https://www.twcert.org.tw/en/cp-139-8299-42168-2.html third-party-advisory