CVE-2021-32671

Executive Summary

CVE-2021-32671 is a stored/cross-context XSS vulnerability in Flarum's translation system, affecting all communities running Flarum v1.0.0 or v1.0.1. The flaw allows any unauthenticated or low-privileged user to inject arbitrary HTML/JavaScript into user input fields, which is then rendered as live DOM nodes on client browsers — enabling session hijacking, account modification, discussion deletion, and administrative takeover when targeting privileged users. The vulnerability carries a maximum CVSS score of 10.0 and has been publicly fixed in flarum/core v1.0.2; all impacted communities must upgrade immediately.

Technical Analysis

The vulnerability stems from a design change introduced after Flarum v0.1.0-beta.16 that was neither noticed nor documented during the transition to the v1.0.0 stable release. Specifically, Flarum's translation system began converting string inputs directly into HTML DOM nodes during rendering. This behavior effectively bypasses the framework's normal output encoding and escaping mechanisms, which are the standard defenses against XSS.

The affected code path can be characterized as follows:

• Input Vector: User-controlled string fields that flow through the translation system (e.g., search box input, profile fields, discussion titles/content).
• Processing: The translation function receives the user string and — due to the unpatched behavioral change — treats it as trusted HTML markup rather than as a plain text string to be escaped.
• Rendering: The resulting HTML is converted into DOM nodes and injected into the page, meaning that any markup supplied by the user is executed by the browser in the context of the victim's session.

Because the flawed conversion is part of the core translation mechanism, the flaw applies to any input field that routes data through this system. The NVD description specifically cites the forum search box as the discovered attack vector, but the underlying mechanism is generic across the application. The fact that the bug was introduced silently and affected every surface routed through the translation layer makes this a systemic flaw rather than a single isolated bad sink.

The vulnerability class is Cross-Site Scripting (XSS) via unsafe HTML injection. The lack of output encoding at the sink — combined with the permissive input handling — results in a direct executable HTML context. This is a stark departure from a typical reflected XSS, which requires a crafted link; here, the payload is stored or rendered immediately, creating a broader attack surface that includes both stored (persistent) and reflected (non-persistent) scenarios.

Attack Surface

• Authentication Level: No elevated privileges required; any user capable of submitting text into a routed field can trigger the injectable rendering.
• Targets: All client browsers of users viewing or interacting with the rendered content, including administrators.
• Exposure: Public-facing forum deployments on the internet are directly reachable; internal community deployments are also at risk but reduce exposure based on network segmentation.

Exploitation Scenarios

Attack Chain (inferred from vulnerability class and NVD description):

Step 1 — Reconnaissance: An attacker identifies a Flarum community running v1.0.0 or v1.0.1. This can be done by fingerprinting the HTTP response headers, the HTML source for Flarum-specific markers, or via version disclosure in generated pages. Tools like Shodan can surface internet-exposed Flarum installations using the dorks listed above.

Step 2 — Triggering the Flaw: The attacker navigates to any user input field that is processed by the translation system. The search box is a confirmed vector, but the attacker may also target profile settings, discussion creation forms, or comment fields. The attacker submits a string that includes HTML/JavaScript payloads.

Step 3 — Payload Execution: Because the translation system renders the input as raw DOM nodes, the submitted markup is executed client-side in the browser of any user who views the affected page. The NVD description explicitly confirms that <script>alert('test')</script> triggers an alert box. The attacker substitutes this with a malicious script that:

• Sends the victim's session cookies or CSRF tokens to an external server.
• Issues authenticated AJAX requests on behalf of the victim (e.g., deleting discussions, changing profile settings, modifying user settings).
• If the victim is an administrator, performs privileged actions such as modifying forum settings, changing admin credentials, or disabling security controls.

Step 4 — Post-Exploitation: Once the attacker has privileged session data, they can maintain persistent access, escalate privileges globally, pivot into the hosting infrastructure if the forum application has file upload or RCE capabilities, and potentially compromise the entire server.

Additional Notes: No public PoC is available, and the attack chain above is inferred from the vulnerability class (stored DOM-based XSS with a confirmed script-execution proof in the NVD description). The AJAX-request capability is explicitly documented in the NVD description, so the attack surface is confirmed beyond simple script pop-up.

Impact Assessment

The CVSS score of 10.0 (Critical) reflects the following characteristics:

• Attack Vector: Network — exploitable remotely.
• Attack Complexity: Low — no special conditions or user interaction beyond viewing the page.
• Privileges Required: None — any user (even unauthenticated if the input is accessible pre-login) can submit payloads.
• User Interaction: None — the victim need not click anything; merely loading the page triggers execution.
• Scope: Changed — the vulnerability in the translation component compromises the security of the entire application.
• Confidentiality, Integrity, Availability: High — full read/write access to forum user data, administrative controls, and potential denial-of-service via discussion deletion.

Business Impact:

• Brand/Trust Damage: A publicly demonstrated alert-box exploit or data exfiltration erodes community trust.
• Regulatory Exposure: If the forum stores personal user data (emails, IPs, profile data), this is a reportable data breach in GDPR/CCPA contexts.
• Operational Disruption: Attackers can delete discussions, deface the forum, or lock out legitimate administrators.

Blast Radius:

• Direct: All Flarum deployments running v1.0.0 and v1.0.1 (published versions at time of disclosure).
• Indirect: Any third-party extensions that reuse the translation system (affected indirectly); integrations (single sign-on, email notifications) may leak session data.

Detection Guidance

Sigma Rule

title: Flarum XSS via Translation System - CVE-2021-32671
id: 9d2b4bb9-4475-4a48-9b3e-9e35d8f2a7c1
status: experimental
description: Detects HTTP requests containing HTML/script payloads targeting Flarum input fields (e.g., search box, profile fields) that may exploit the translation-system XSS flaw.
logsource:
  category: webserver
  product: apache
  service: access
detection:
  selection_script:
    cs-method: GET|POST
    cs-uri-query|contains:
      - '<script'
      - '<img'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - 'alert('
  selection_flarum:
    cs-uri-query|contains:
      - 'q='          # search parameter (common)
      - 'search'
      - 'profile'
      - 'settings'
  condition: selection_script and selection_flarum
fields:
  - client_ip
  - cs-uri-query
falsepositives:
  - Legitimate forum users discussing HTML in search queries (rare)
level: high

YARA Rule

rule Flarum_XSS_Translation_CVE_2021_32671
{
    meta:
        author = "ValterIT Threat Intel"
        description = "Detects HTML/script injection payload patterns in Flarum traffic"
        date = "2025-01-15"
        cve = "CVE-2021-32671"
    strings:
        $s1 = "<script>" ascii wide
        $s2 = "<img" ascii wide
        $s3 = "onerror=" ascii wide nocase
        $s4 = "javascript:" ascii wide nocase
        $s5 = "alert(" ascii wide nocase
        $s6 = "fetch(" ascii wide nocase
        $s7 = "XMLHttpRequest" ascii wide nocase
    condition:
        any of ($s*) and filesize < 500KB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT Flarum XSS Injection Attempt (CVE-2021-32671)";
    flow:established,to_server;
    content:"<script"; http_uri; nocase;
    pcre:"/(<script|<img|onerror=|onload=|javascript:|alert\()/Ui";
    metadata: former_category EXPLOIT;
    reference: cve, 2021-32671;
    classtype: attempted-user;
    sid: 2021001;
    rev: 1;
)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.type == "start" and destination.port in (80, 443) ]
  [ http where
      http.request.method in ("GET", "POST") and
      (
        url.query contains "<script" or
        url.query contains "<img" or
        url.query contains "javascript:" or
        url.query contains "onerror=" or
        url.query contains "alert("
      ) and
      (
        url.path contains "search" or
        url.path contains "profile" or
        url.path contains "settings"
      )
  ]

Splunk SPL Query

index=web sourcetype=access_combined
| where (uri_query LIKE "*%3Cscript%*" OR uri_query LIKE "*%3Cimg%*" OR uri_query LIKE "*javascript%*" OR uri_query LIKE "*onerror%*" OR uri_query LIKE "*alert%*")
  AND (uri_path LIKE "*q*" OR uri_path LIKE "*search*" OR uri_path LIKE "*profile*" OR uri_path LIKE "*settings*")
| stats count by clientip, uri_path, uri_query, status
| sort - count
| table _time, clientip, uri_path, uri_query, status, count

Wazuh OSSEC Rule

<rule id="100301" level="10">
  <if_sid>31100</if_sid>  <!-- Apache access log -->
  <match>(&lt;script|%3Cscript|&lt;img|%3Cimg|onerror|javascript:)</match>
  <regex>(q=|search|profile|settings)</regex>
  <description>CVE-2021-32671 - Flarum XSS via translation system (script injection detected)</description>
  <group>web_attack, xss, flarum, cve_2021_32671,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
  <options>no_full_log</options>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED is the automated verdict because no patch sources are tracked in the CVE data. However, the NVD description explicitly confirms the fix was published as flarum/core v1.0.2.

1) Immediate Mitigations (Required Now)

• Upgrade to flarum/core v1.0.2 — this is the only confirmed fix. Deploy as an emergency change across all environments.
• If upgrade is not immediately possible, disable or restrict the search box user access (e.g., hide the feature for unauthenticated users or disable search entirely) as an interim control.
• Disable registration until the upgrade is applied, to reduce the unauthenticated attack surface.
• Apply a WAF rule to block requests containing <script, onerror=, onload=, javascript: in query parameters that are routed to Flarum user-input handlers.
• Monitor access logs for the patterns in the detection rules above and prioritize alerts on clientip originating from external networks.

2) Patch/Upgrade Steps

• Backup the database and application files.
• Upgrade to flarum/core v1.0.2 or later using the official Flarum upgrade procedures (composer update flarum/core --with-dependencies).
• Run database migrations and clear the application cache.
• Verify version in the admin panel and confirm the translation system now escapes HTML output.
• Test the search box with a harmless <b>test</b> payload to confirm it renders as text, not HTML.

3) Long-Term Hardening

• Enforce a Content Security Policy (CSP) that disallows inline script execution (script-src 'self' 'nonce-...') to contain future XSS bypasses.
• Implement output encoding (HTML entity escaping) in any custom extensions that interface with Flarum's translation layer.
• Add an HTTP response header X-Content-Type-Options: nosniff to reduce MIME sniffing.
• Establish a patching cadence that applies Flarum security releases within 72 hours of publication.
• Subscribe to the Flarum security mailing list and CVE feed that sources vulnerability data.
• Implement least-privilege admin accounts and enforce MFA on admin panel.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2021-32671
2. Flarum GitHub Advisory (core v1.0.2 release): https://github.com/flarum/core/releases/tag/v1.0.2
3. Flarum Official Announcement / Changelog: https://discuss.flarum.org/
4. CWE-79 Reference (XSS): https://cwe.mitre.org/data/definitions/79.html
5. CISA KEV: Not listed — no known active exploitation in the wild has been confirmed via CISA KEV as of the data provided.

Threat Actor Activity: No specific threat actor campaigns are documented in the provided data. The NVD description does not indicate active exploitation campaigns, only the initial discovery via a proof-of-concept alert box by a community member. Given the EPSS percentile rank (98.5%), the community is actively discussing and likely exploiting this easily accessible flaw.