CVE-2024-22876
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedStrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case attachment functionality which enables an attacker to upload a malicious HTML file with Javascript code that will be executed in the context of the The Hive application using a specific URL. The vulnerability can be used to coerce a victim account to perform specific actions on the application as helping an analyst becoming administrator.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceTheHive versions 5.1.0-5.1.9 and 5.2.0-5.2.8 suffer from a stored XSS vulnerability in the case attachment upload feature. Attackers can upload malicious HTML files containing JavaScript that executes when the victim accesses the file via a specific URL, allowing session hijacking and privilege escalation.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data>= 5.1.0, <= 5.1.9>= 5.2.0, <= 5.2.8CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify installed TheHive versionCheck the running TheHive version through the admin interface (Help > About) or by examining the application startup logs, or query the API endpoint /api/statusAffected if The installed version falls within 5.1.0-5.1.9 or 5.2.0-5.2.8
-
Verify attachment upload feature is accessibleLog into TheHive with a valid user account and navigate to a case, then attempt to access the attachment upload functionality (typically via Add attachment or similar button in the case view)Affected if User can access the case attachment upload feature and has permissions to upload files
-
Test HTML file upload capabilityUpload a benign test HTML file (containing non-executable content like a simple heading) to a case via the attachment feature and observe whether the upload succeedsAffected if The system accepts and stores HTML file uploads without blocking or sanitizing them
-
Confirm HTML content is served without sanitizationAccess the uploaded test HTML file through the direct download/view URL pattern (typically /case/attachment/{id}/file) and verify the browser renders the HTML content rather than displaying it as plain text or blocking itAffected if Uploaded HTML files are served with content-type that allows browser rendering (text/html) or are otherwise accessible for script execution
-
Check for CSP headers on attachment responsesUse browser developer tools or a command-line HTTP client to inspect response headers when accessing an attachment URL; verify if Content-Security-Policy header is present and restricts inline script executionAffected if No Content-Security-Policy header is set on attachment responses, or the policy allows 'unsafe-inline' for scripts
You are affected if TheHive version is between 5.1.0-5.1.9 or 5.2.0-5.2.8 AND the system accepts HTML file uploads in case attachments AND those files are accessible for browser rendering without CSP protection.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedImplement strict file type validation to block HTML file uploads in attachments, apply Content Security Policy headers to prevent script execution, and sanitize or rename uploaded files to prevent direct HTML rendering.
TheHive 5.2.9 or later (or 5.1.10 or later for the 5.1 branch)
- 1. Identify the currently installed TheHive version by checking the application's version information
- 2. If running version 5.1.x (5.1.0 to 5.1.9), upgrade to version 5.1.10 or later
- 3. If running version 5.2.x (5.2.0 to 5.2.8), upgrade to version 5.2.9 or later
- 4. Follow the standard TheHive upgrade procedure for your deployment method (Docker, RPM/DEB package, or binary)
- 5. After upgrade, verify the new version is running and the application functions normally
- 6. Review TheHive release notes for any additional security fixes included in the new version
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation3.0 h
- Implementation8.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,800.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2024-22876 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2024-22876 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data