CVE-2024-50348: Stored XSS Vulnerability in InstantCMS - Astra Security Blog

Product Name: InstantCMS

Vulnerability: Stored XSS

Vulnerable Version: 2.16.2 & <2.16.2

CVE: CVE-2024-50348

The researchers from Astra’s security team, on November 6, 2024, found a Stored Cross-Site Scripting (XSS) in InstantCMS, a free and open-source CMS that allows you to build websites. The vulnerability was identified in the photo album page’s photo upload function.

A stored XSS vulnerability occurs when an application allows malicious user input, is stored without proper sanitization, and is accessible to other application users.

CVE-2024-50348: Technical Breakdown

How Was It Discovered?

While testing on the demo app, Astra’s security researchers discovered that the uploaded images were not properly sanitized, allowing the injection of malicious scripts along with the images.

During the analysis, the <img> tag was used to embed the uploaded images with the XSS payload using the onerror attribute.

How To Recreate This Vulnerability?

Inject Payload
Insert the following payload in the Camera Model Name metadata field:

test<img src="asd" onerror="alert(1)">

Submit Request
Upload the image on the photo upload page

Observe Rendering

• Visit the https://demo.instantcms.io/photos/camera-{payload}
• The error occurs, and you can observe the immediate execution of the injected XSS payload.

Impact of Stored XSS

Session Hijacking

Once the image is injected, attackers can target users who visit the affected page and steal sensitive user session information like cookies and session tokens, leading to account takeovers.

Malware Propagation

The attackers can leverage the stored XSS vulnerability to deploy malware or ransomware. Once the payload is stored, malicious scripts affect any vulnerable page user.

Website Defacement

Malicious scripts can modify the content on web pages, presenting misleading information or making it hard for users to identify malicious content and engage with it.

It is one small security loophole v/s your entire website or web application.

Current Status

Once the vulnerability was found, researchers notified the development team of InstantCMS, who then acknowledged the vulnerability in versions <2.16.3 of the application. This issue was mitigated by sanitizing the uploaded images and clearing the metadata in their update in v2.16.3.

What Can You Do?

To avoid potential exploitation, users are strongly advised to update InstantCMS to the latest version, which includes essential security patches.

Author

Prateek Kuber
Prateek is a cybersecurity professional with a strong interest in coding and a knack for crafting detailed, informative articles. Outside the world of cybersecurity, he enjoys a weekly game of football and something to binge watch!