CVE-2024-51991

Executive Summary

CVE-2024-51991 is a vulnerability in October CMS, a popular Content Management System and web platform. The flaw resides in the media manager's SVG sanitization feature, controlled by the media.clean_vectors configuration. An authenticated administrator with access to the administration panel can bypass the sanitization by uploading a malicious SVG file with a permitted extension (e.g., .jpg or .png) and then renaming it to .svg. This allows the attacker to inject malicious content, such as JavaScript, into the SVG file, which could be used for Cross-Site Scripting (XSS) attacks against other trusted users. The vulnerability requires a trusted user to attack another trusted user and cannot be exploited without administrative access and user interaction. The patch is available in version 3.7.5.

Supply Chain & Package Security

October CMS is a PHP-based application distributed via Composer. The vulnerability is in the core media manager component. Users should ensure their Composer dependencies are updated to the patched version. No third-party package is directly affected, but the integrity of the CMS itself is compromised if not patched.

CVSS Breakdown & Threat Level

The CVSS score is not provided in the NVD data. However, based on the description, a reasonable assessment would be:

• Attack Vector (AV): Network (the attack is performed over the network via the admin panel)
• Attack Complexity (AC): Low (the bypass is straightforward)
• Privileges Required (PR): High (requires authenticated administrator access)
• User Interaction (UI): Required (the victim must interact with the malicious SVG)
• Scope (S): Changed (the vulnerability allows an attacker to impact resources beyond the original scope)
• Confidentiality (C): Low (potential information disclosure via XSS)
• Integrity (I): Low (potential modification of content via XSS)
• Availability (A): None

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Estimated Score: 4.8 (Medium)

Deep Dive & Mechanics

The vulnerability exploits a flaw in the file upload and renaming process within the October CMS media manager. The media.clean_vectors configuration is designed to sanitize SVG files by removing potentially malicious content (e.g., <script> tags, event handlers). However, the sanitization is only applied when the file is initially uploaded with an .svg extension. If an attacker uploads a file with a permitted extension (like .jpg or .png) that contains SVG content, the sanitization is bypassed. Later, the attacker can rename the file to .svg using the media manager's rename functionality. This renamed file is not re-sanitized, allowing the malicious SVG content to be served to other users.

The attack flow:

1. Attacker logs into the October CMS administration panel.
2. Attacker creates a malicious SVG file containing JavaScript (e.g., <script>alert('XSS')</script>).
3. Attacker renames the file to malicious.jpg (or another permitted extension).
4. Attacker uploads malicious.jpg via the media manager. The sanitization is not triggered because the extension is not .svg.
5. Attacker uses the media manager's rename feature to change the file name to malicious.svg.
6. The file is now served as an SVG without sanitization.
7. Attacker tricks another administrator into viewing the SVG file (e.g., by embedding it in a page or sending a link).
8. The victim's browser executes the malicious JavaScript, leading to XSS.

Vulnerable vs. Patched Code

The vulnerable code likely resides in the media manager's upload and rename logic. The patch in v3.7.5 ensures that any file renamed to .svg is also sanitized.

Vulnerable Code (Conceptual):

// In the upload handler
if ($file->extension == 'svg') {
    $file = sanitizeSvg($file);
}
// In the rename handler
$file->rename($newName);
// No sanitization check after rename

Patched Code (Conceptual):

// In the upload handler
if ($file->extension == 'svg') {
    $file = sanitizeSvg($file);
}
// In the rename handler
$file->rename($newName);
if ($file->extension == 'svg') {
    $file = sanitizeSvg($file);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an October CMS admin panel (version < 3.7.5).
• The media.clean_vectors configuration must be enabled.
• A target user (another admin) who will view the malicious SVG.

Steps:

1. Create a malicious SVG file:

   <?xml version="1.0" encoding="UTF-8"?>
   <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
       <script>alert('XSS')</script>
   </svg>
   

2. Rename the file to malicious.jpg.
3. Upload malicious.jpg via the media manager.
4. Rename the uploaded file to malicious.svg using the media manager's rename feature.
5. Embed the SVG in a page or send a direct link to the victim.
6. When the victim views the SVG, the JavaScript executes.

Blue Team

Detection:

• Monitor for file uploads with extensions that are later renamed to .svg.
• Monitor for unusual file content (e.g., SVG content in files with non-SVG extensions).
• Use file integrity monitoring to detect changes in file extensions.

Prevention:

• Apply the patch by upgrading to October CMS v3.7.5.
• Disable media.clean_vectors if not needed.
• Restrict admin panel access to trusted users only.
• Implement additional input validation and sanitization for all uploaded files.

Indicators of Compromise (IOCs)

• File: malicious.svg (or any SVG file with unexpected content)
• Log Entry: File rename events in the media manager logs (e.g., renamed malicious.jpg to malicious.svg)
• Network: HTTP requests to /storage/app/media/malicious.svg (or similar path)
• Behavior: Unusual JavaScript execution in the admin panel

Detection Engineering

YARA Rule

rule CVE_2024_51991_SVG_Bypass {
    meta:
        description = "Detects SVG files that may have bypassed sanitization in October CMS"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-51991"
    strings:
        $svg_header = "<?xml" nocase
        $svg_tag = "<svg" nocase
        $script_tag = "<script" nocase
        $on_event = /on\w+\s*=/ nocase
    condition:
        $svg_header and $svg_tag and ($script_tag or $on_event)
}

Sigma Rule

title: October CMS SVG Sanitization Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file rename events that may indicate an SVG sanitization bypass in October CMS
author: Valters IT
date: 2024-01-01
logsource:
    category: application
    product: octobercms
detection:
    selection:
        EventID: "media.file.renamed"
        NewExtension: "svg"
        OldExtension: 
            - "jpg"
            - "jpeg"
            - "png"
            - "gif"
    condition: selection
falsepositives:
    - Legitimate renaming of files by administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51991 - October CMS SVG Sanitization Bypass"; flow:to_server,established; content:"/storage/app/media/"; http_uri; pcre:"/\.svg$/"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade to October CMS v3.7.5 or later.
• If upgrade is not possible, disable the media.clean_vectors configuration option.

Long-term:

• Implement a Web Application Firewall (WAF) to block malicious SVG uploads.
• Conduct regular security audits of the CMS and its plugins.
• Train administrators on the risks of file uploads and the importance of verifying file content.

Valters IT Signature: This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further assistance, contact us at valters@example.com.