CVE-2023-31699

Executive Summary

CVE-2023-31699 is a reflected Cross-Site Scripting (XSS) vulnerability in ChurchCRM version 4.5.4. The flaw allows an authenticated attacker to inject arbitrary JavaScript code by uploading a specially crafted JPEG image file containing an XSS payload in its metadata (e.g., via ExifTool). When the image is processed by the CSV import functionality, the payload is reflected back to the victim's browser, leading to session hijacking, data theft, or further compromise. The vulnerability has a low CVSS score of 3.5 due to the requirement for authentication and user interaction, but it poses a significant risk in shared or administrative environments.

Supply Chain & Package Security

ChurchCRM is a PHP-based open-source application. The vulnerability exists in the core application code, not in a third-party package. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must view the uploaded image)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Low (due to authentication requirement), but elevated in multi-tenant or admin-heavy deployments.

Deep Dive & Mechanics

The vulnerability resides in the CSV import functionality of ChurchCRM. When an authenticated user uploads a CSV file, the application also processes associated image files (e.g., JPEG) for user profiles or event images. The application fails to sanitize or escape metadata embedded in the image file, such as the Comment or Artist EXIF fields. An attacker can inject a JavaScript payload into these fields using tools like ExifTool. When the image is rendered in the browser (e.g., in the admin panel or user profile), the payload executes in the context of the victim's session.

Root Cause: Lack of output encoding for image metadata when displayed in HTML.

Attack Flow:

1. Attacker logs into ChurchCRM as an authenticated user.
2. Attacker navigates to Admin > CSV Import.
3. Attacker uses ExifTool to embed an XSS payload into a JPEG file: exiftool -Comment='<script>alert(1)</script>' payload.jpg
4. Attacker uploads the malicious JPEG via the CSV import form.
5. When an admin or other user views the uploaded image (e.g., in the user list or profile), the payload executes.

Vulnerable vs. Patched Code

Vulnerable Code (ChurchCRM 4.5.4): The application likely uses PHP's exif_read_data() to extract metadata and directly echoes it without sanitization.

// Vulnerable example (conceptual)
$exif = exif_read_data($imageFile);
echo "<img src='$imagePath' alt='" . $exif['COMMENT'] . "'>";

Patched Code (Hypothetical): The fix would involve HTML-encoding the metadata before output.

// Patched example
$exif = exif_read_data($imageFile);
$safeComment = htmlspecialchars($exif['COMMENT'], ENT_QUOTES, 'UTF-8');
echo "<img src='$imagePath' alt='$safeComment'>";

No official patch has been released by the vendor.

Exploitation & Lab Setup

Red Team

Prerequisites:

• ChurchCRM 4.5.4 instance
• Authenticated user credentials
• ExifTool installed

Exploit Steps:

1. Prepare a malicious JPEG file with an XSS payload:

   exiftool -Comment='<script>alert(document.cookie)</script>' -o malicious.jpg original.jpg
   

2. Log in to ChurchCRM.
3. Navigate to Admin > CSV Import.
4. Upload the malicious.jpg file.
5. When the image is displayed (e.g., in the user list), the XSS triggers.

Exploit-DB Code (Provided):

# Exploit Title: ChurchCRM v4.5.4 - Reflected XSS via Image (Authenticated)
# Date: 2023-04-17
# Exploit Author: Rahad Chowdhury
# Vendor Homepage: http://churchcrm.io/
# Software Link: https://github.com/ChurchCRM/CRM/releases/tag/4.5.4
# Version: 4.5.4
# Tested on: Windows 10, PHP 7.4.29, Apache 2.4.53
# CVE: CVE-2023-31699

Steps to Reproduce:

1. At first login your admin panel.
2. Then click the "Admin" menu and click "CSV Import '' and you will get
the CSV file uploader option.
3. now insert xss payload in jpg file using exiftool or from image
properties and then upload the jpg file.
4. you will see XSS pop up.

Blue Team

Detection:

• Monitor for uploads of JPEG files with unusual EXIF metadata (e.g., Comment field containing <script> tags).
• Use WAF rules to block file uploads containing JavaScript in metadata.
• Review access logs for the CSV import endpoint.

Mitigation:

• Disable the CSV import feature if not needed.
• Implement strict input validation and output encoding for all user-supplied data, including image metadata.
• Apply a virtual patch using a WAF to filter XSS payloads in uploaded files.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example - replace with actual)
  • malicious.jpg: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
• Network Indicators:
  • HTTP POST requests to /api/csv/import or similar endpoints.
  • Outbound connections to attacker-controlled domains (if payload exfiltrates data).
• File System Indicators:
  • JPEG files with EXIF Comment field containing <script> tags.
• Log Indicators:
  • PHP error logs showing exif_read_data() warnings.
  • Web server access logs with POST to CSV import endpoint.

Detection Engineering

YARA Rule

rule CVE_2023_31699_ChurchCRM_XSS {
    meta:
        description = "Detects JPEG files with XSS payload in EXIF Comment field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-31699"
    strings:
        $exif_comment = /(?i)Comment/
        $xss_payload = /<script[^>]*>.*?<\/script>/s
    condition:
        $exif_comment and $xss_payload
}

Sigma Rule

title: ChurchCRM Reflected XSS via Image Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects upload of JPEG files with XSS payload in EXIF metadata
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '.jpg'
        TargetFilename|contains: 'ChurchCRM'
    condition: selection
falsepositives:
    - Legitimate use of special characters in image metadata
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-31699 ChurchCRM XSS via Image Upload"; flow:to_server,established; content:"POST"; http_method; content:"/api/csv/import"; http_uri; content:"multipart/form-data"; http_header; pcre:"/<script[^>]*>.*?<\/script>/si"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the CSV import feature if not required.
2. Short-term: Implement a WAF rule to block file uploads containing <script> tags in EXIF metadata.
3. Long-term: Upgrade to a patched version of ChurchCRM (if available) or apply the following code fix:
   • Sanitize all EXIF metadata using htmlspecialchars() before output.
   • Validate uploaded files to ensure they are legitimate images (e.g., re-encode them).
4. Monitor: Review logs for any exploitation attempts.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 38BE672D6DD942C1CDCF5487] */}