CVE-2024-45612

Executive Summary

CVE-2024-45612 is a medium-severity Cross-Site Scripting (XSS) vulnerability in the Contao Open Source CMS. An untrusted user can inject malicious insert tags into the canonical tag of a page. When the page is rendered on the front end, these insert tags are processed and replaced, potentially leading to arbitrary HTML/JavaScript execution in the context of the victim's browser. The vulnerability affects all Contao versions prior to 4.13.49, 5.3.15, and 5.4.3. The official patch involves sanitizing insert tags within the canonical tag output. As a workaround, administrators can disable canonical tags in the root page settings.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Attack Vector (AV): Network - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low - No special conditions are required.
• Privileges Required (PR): None - An unauthenticated user can trigger the vulnerability.
• User Interaction (UI): Required - The victim must visit a crafted URL or page.
• Scope (S): Unchanged - The exploit cannot affect resources beyond the vulnerable component.
• Confidentiality (C): Low - Limited information disclosure is possible.
• Integrity (I): Low - Limited data modification is possible.
• Availability (A): None - No impact on system availability.

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation (no authentication, low complexity) and the potential for phishing or session hijacking elevate the risk for unpatched instances.

Deep Dive & Mechanics

The vulnerability resides in how Contao processes the <link rel="canonical"> tag. The canonical tag is used to specify the preferred URL for a page to prevent duplicate content issues. In affected versions, the value of the canonical tag is not properly sanitized before being rendered in the HTML <head>.

An attacker can craft a URL containing malicious insert tags (e.g., {{insert_tag::...}}) in the path or query string. When Contao generates the canonical tag for that page, it includes the attacker-controlled input without escaping. The insert tags are then processed by Contao's template engine, which can execute arbitrary PHP functions or include external content.

For example, a URL like:

https://vulnerable-site.com/{{request::script}}?canonical={{env::page}}

could cause the canonical tag to become:

<link rel="canonical" href="https://vulnerable-site.com/{{request::script}}?canonical={{env::page}}">

When the page is rendered, the insert tags are replaced, potentially executing malicious code.

Vulnerable vs. Patched Code

Vulnerable Code (Contao < 4.13.49, < 5.3.15, < 5.4.3):

// In a template or controller that generates the canonical tag
$canonical = $this->getCanonicalUrl(); // User input is not sanitized
echo '<link rel="canonical" href="' . $canonical . '">';

Patched Code (Contao >= 4.13.49, >= 5.3.15, >= 5.4.3):

// The canonical URL is now sanitized to prevent insert tag injection
$canonical = $this->getCanonicalUrl();
$canonical = strip_insert_tags($canonical); // New sanitization function
echo '<link rel="canonical" href="' . $canonical . '">';

The patch introduces a function strip_insert_tags() that removes or escapes any insert tag syntax from the canonical URL before it is output.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy a vulnerable Contao instance (e.g., version 4.13.48).
2. Craft Payload: Create a URL containing a malicious insert tag. For example:

   http://target-site.com/{{script::alert('XSS')}}
   

3. Deliver Payload: Send the crafted URL to a victim via email, social media, or a link on another site.
4. Trigger: When the victim visits the URL, the canonical tag is rendered with the insert tag. The insert tag is processed, executing the JavaScript alert('XSS').
5. Escalate: Use more sophisticated insert tags to steal cookies, redirect to phishing pages, or perform actions on behalf of the victim.

Blue Team (Detection & Defense)

1. Identify Vulnerable Instances: Scan internal networks for Contao CMS instances. Check version numbers in the HTTP response headers or /contao/install page.
2. Monitor Logs: Look for unusual URL patterns containing {{ or }} in web server access logs.
3. WAF Rules: Deploy a Web Application Firewall (WAF) rule to block requests containing insert tag syntax in the URL path or query string.
4. Harden Configuration: If patching is not immediately possible, disable canonical tags in the Contao root page settings as a temporary workaround.

Indicators of Compromise (IOCs)

• URL Patterns: Requests containing {{ and }} in the path or query string, especially with keywords like script, request, env, post, session.
• HTTP Response: Presence of unexpected JavaScript or HTML in the <link rel="canonical"> tag.
• Server Logs: Entries showing 200 responses to URLs with insert tag syntax.
• Client-Side: Unusual JavaScript execution or cookie theft in the victim's browser.

Detection Engineering

YARA Rule

rule CVE_2024_45612_Contao_Canonical_XSS {
    meta:
        description = "Detects attempts to exploit CVE-2024-45612 in Contao CMS"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-45612"
    strings:
        $insert_tag = /\{\{[a-zA-Z_]+::/
        $canonical = /<link rel="canonical"/
    condition:
        $canonical and $insert_tag
}

Sigma Rule

title: CVE-2024-45612 Contao Canonical Tag Insert Tag Injection
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2024-45612 by injecting insert tags into the canonical tag.
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '{{'
        cs-uri-query|contains: '}}'
    condition: selection
falsepositives:
    - Legitimate use of insert tags in other contexts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45612 Contao Canonical Tag Insert Tag Injection"; flow:to_server,established; content:"{{"; http_uri; content:"}}"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade Contao to version 4.13.49, 5.3.15, or 5.4.3.
2. Workaround: If patching is not possible, disable canonical tags in the Contao root page settings (System > Settings > Root Pages > Disable canonical tag).
3. WAF Rules: Block requests containing {{ and }} in the URL path or query string.
4. Input Validation: Ensure all user-supplied data is sanitized before being used in HTML attributes.
5. Monitor: Review web server logs for suspicious URL patterns and investigate any alerts from the detection rules.

Report generated by Valters IT DevSecOps & CTI Division