CVE-2020-36828

Executive Summary

CVE-2020-36828 is a reflected Cross-Site Scripting (XSS) vulnerability in the DiscuzX forum software, affecting versions up to 3.4-20200818. The flaw resides in the show_next_step function within the upload/install/include/install_function.php file. An attacker can inject arbitrary JavaScript by manipulating the uchidden argument during the installation process. While the CVSS score is low (3.5), the vulnerability can be exploited remotely without authentication, making it a potential vector for phishing or session hijacking. The vendor has released a patch in version 3.4-20210119, but no public exploit code or proof-of-concept is currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone PHP application (DiscuzX) and does not involve a package manager supply chain.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The low score reflects the need for user interaction (e.g., clicking a crafted link) and the limited impact (only integrity is affected). However, in a social engineering context, this could lead to credential theft or session hijacking.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the DiscuzX installation wizard. The show_next_step function in upload/install/include/install_function.php outputs the uchidden parameter without proper sanitization or encoding. An attacker can craft a URL like:

http://target.com/upload/install/index.php?uchidden=<script>alert('XSS')</script>

When a victim visits this URL during the installation phase, the injected script executes in the context of the target domain. The installation wizard is typically accessible only during initial setup, but if left exposed, it can be exploited at any time.

The root cause is the lack of output encoding for user-supplied input. The uchidden parameter is used to store hidden form fields, but it is echoed directly into the HTML without escaping.

Vulnerable vs. Patched Code

Vulnerable Code (version 3.4-20200818):

function show_next_step($step, $uchidden) {
    echo '<input type="hidden" name="uchidden" value="' . $uchidden . '">';
}

Patched Code (version 3.4-20210119):

function show_next_step($step, $uchidden) {
    echo '<input type="hidden" name="uchidden" value="' . htmlspecialchars($uchidden, ENT_QUOTES, 'UTF-8') . '">';
}

The patch applies htmlspecialchars() to encode HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team

No public exploit code is available. To simulate the attack in a lab:

1. Set up a vulnerable DiscuzX instance (version 3.4-20200818).
2. Access the installation wizard: http://target/upload/install/index.php
3. Craft a malicious URL:

   http://target/upload/install/index.php?uchidden=<script>alert(document.cookie)</script>
   

4. Send the link to a victim (requires user interaction).

Blue Team

To detect exploitation attempts:

• Monitor web server logs for requests to /upload/install/index.php with suspicious uchidden parameters containing <script> tags or encoded variants.
• Use WAF rules to block XSS patterns in the uchidden parameter.
• Ensure the installation wizard is removed or disabled after initial setup.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /upload/install/index.php with uchidden parameter containing <script>, onerror, javascript:, or other XSS payloads.
• File: Presence of the file upload/install/include/install_function.php with the vulnerable code (no htmlspecialchars).
• Logs: Web server access logs showing GET /upload/install/index.php?uchidden=... with encoded or raw XSS payloads.

Detection Engineering

YARA Rule

rule CVE_2020_36828_XSS {
    meta:
        description = "Detects vulnerable DiscuzX install_function.php with missing htmlspecialchars"
        author = "Valters IT"
        date = "2025-04-17"
        cve = "CVE-2020-36828"
    strings:
        $vuln = "value=\" . $uchidden" ascii wide
        $patch = "htmlspecialchars" ascii wide
    condition:
        $vuln and not $patch
}

Sigma Rule

title: DiscuzX Installation Wizard XSS Attempt
id: 8a3f7c2e-1b4d-4e9f-8c6a-5d2b7f3e1a0c
status: experimental
description: Detects XSS attempts against DiscuzX installation wizard via uchidden parameter
author: Valters IT
date: 2025/04/17
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/upload/install/index.php'
        cs-uri-query|contains: 'uchidden='
        cs-uri-query|re: '(?i)(<script|onerror|javascript:|alert\(|prompt\(|confirm\()'
    condition: selection
falsepositives:
    - Legitimate use of the installation wizard with non-malicious parameters
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2020-36828 DiscuzX Installation Wizard XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/upload/install/index.php"; http_uri; content:"uchidden="; http_uri; pcre:"/(?i)(<script|onerror|javascript:|alert\(|prompt\(|confirm\()/Ri"; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

1. Upgrade DiscuzX to version 3.4-20210119 or later.
2. Apply the patch manually by adding htmlspecialchars() to the show_next_step function.
3. Remove or disable the installation wizard after initial setup (delete upload/install/ directory).
4. Implement WAF rules to block XSS patterns in the uchidden parameter.
5. Monitor logs for suspicious requests to the installation wizard.

Valters IT
DevSecOps & Cyber Threat Intelligence