Chunghwa Telecom TenderDocTransfer - Reflected Cross-site Scripting to RCE

The impact of this XSS vulnerability is significant due to the potential for OS command execution. An attacker could craft a phishing link containing malicious JavaScript that, when clicked by a user, would execute the code in their browser. Given that TenderDocTransfer uses Node.js, this malicious script could be leveraged to execute arbitrary commands on the server hosting the application. This could lead to complete system compromise, data exfiltration, and further malicious activity. The lack of CSRF protection exacerbates the risk, as attackers can easily trigger these API calls without user interaction beyond clicking a link.

Organizations and individuals utilizing TenderDocTransfer in their workflows are at risk, particularly those relying on the application for sensitive data transfer. Shared hosting environments where multiple users share the same server instance are especially vulnerable, as a successful attack could potentially impact other users on the same server.

• nodejs / server:

grep -r 'TenderDocTransfer' /var/log/nodejs/

• generic web:

curl -I <target_url> | grep -i 'X-XSS-Protection'

• generic web:

curl -I <target_url> | grep -i 'Content-Security-Policy'

1. 2024-12-16Disclosure

   disclosure

1. Reserviert2024-12-16
2. Veröffentlicht2024-12-16
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-12641 is to immediately upgrade TenderDocTransfer to version 0.41.157 or later. If upgrading is not immediately feasible, implement strict input validation and output encoding on all API endpoints to prevent the injection of malicious scripts. Consider implementing a Content Security Policy (CSP) to restrict the sources from which scripts can be executed. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Monitor API request logs for suspicious patterns, such as unusual characters or URLs.