CVE-2024-46209
📋 TL;DR
A stored cross-site scripting (XSS) vulnerability in REDAXO CMS v5.17.1 allows attackers to inject malicious scripts into the password parameter of the /media/test.html component. This enables execution of arbitrary web scripts or HTML when users access the compromised page. All REDAXO CMS v5.17.1 installations with the vulnerable component are affected.
💻 Affected Systems
- REDAXO CMS
📦 What is this software?
Redaxo by Redaxo
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform account takeover, deface websites, or redirect users to malicious sites, potentially leading to complete system compromise if combined with other vulnerabilities.
Likely Case
Attackers inject malicious JavaScript to steal user session cookies or credentials, potentially gaining administrative access to the CMS backend.
If Mitigated
With proper input validation and output encoding, the payload would be rendered harmless as text rather than executable code.
🎯 Exploit Status
The GitHub repository contains proof-of-concept code demonstrating the vulnerability. The exploit requires access to the vulnerable endpoint but doesn't require authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified
Vendor Advisory: Not found
Restart Required: No
Instructions:
1. Check REDAXO CMS official website for security updates
2. Upgrade to a patched version when available
3. Remove or secure the /media/test.html component immediately
🔧 Temporary Workarounds
Remove vulnerable component
linuxDelete or restrict access to the /media/test.html file
rm /path/to/redaxo/media/test.html
Implement WAF rules
allAdd web application firewall rules to block XSS payloads targeting the password parameter
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to prevent script execution
- Deploy a web application firewall (WAF) with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Check if /media/test.html exists in your REDAXO installation and test with a harmless XSS payload like <script>alert('test')</script> in the password parameterCheck Version:
Check REDAXO version in admin panel or examine /redaxo/data/core/config.ymlVerify Fix Applied:
After removing the file or implementing controls, attempt to access /media/test.html and verify it returns 404 or properly sanitizes input📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /media/test.html with script tags or encoded payloads in parameters
- Unusual POST requests to test.html endpoint
Network Indicators:
- Traffic patterns showing repeated access to test.html with encoded payloads
SIEM Query:
source="web_logs" AND uri_path="/media/test.html" AND (query_string CONTAINS "script" OR query_string CONTAINS "javascript:" OR query_string CONTAINS "onerror=")