CVE-2024-46606
📋 TL;DR
A stored cross-site scripting (XSS) vulnerability in Piwigo's photo description field allows attackers to inject malicious scripts that execute when administrators view the affected page. This affects Piwigo v14.5.0 installations with admin panel access. Attackers could potentially hijack admin sessions or perform unauthorized actions.
💻 Affected Systems
- Piwigo
📦 What is this software?
Piwigo by Piwigo
⚠️ Risk & Real-World Impact
Worst Case
Administrator account compromise leading to full site takeover, data theft, or server-side code execution through chained attacks.
Likely Case
Session hijacking of admin users, defacement, or theft of admin credentials.
If Mitigated
Limited impact if proper input validation and output encoding are implemented, or if admin access is restricted.
🎯 Exploit Status
Exploitation requires authenticated access to the admin panel; proof-of-concept details are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v14.5.1 or later
Vendor Advisory: https://github.com/Piwigo/Piwigo
Restart Required: No
Instructions:
1. Backup your Piwigo installation and database. 2. Download the latest version from the official Piwigo repository. 3. Replace the affected files with the patched version. 4. Verify the fix by testing the photo description field.
🔧 Temporary Workarounds
Input Sanitization
allImplement server-side input validation and output encoding for the photo description field.
Restrict Admin Access
linuxLimit admin panel access to trusted IP addresses using web server configuration.
# Apache: Use .htaccess with Require ip
# Nginx: Use allow/deny directives in server block
🧯 If You Can't Patch
- Disable or restrict access to the /admin.php?page=photo component if not essential.
- Implement a web application firewall (WAF) with XSS protection rules.
🔍 How to Verify
Check if Vulnerable:
Test by injecting a simple XSS payload (e.g., <script>alert('test')</script>) into the photo description field and check if it executes when viewed.Check Version:
Check the Piwigo version in the admin panel or via the /admin.php?page=about page.Verify Fix Applied:
After patching, repeat the XSS test; the payload should be properly sanitized and not execute.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /admin.php?page=photo with script tags in parameters
- Admin session anomalies or unexpected admin actions
Network Indicators:
- HTTP requests containing malicious script payloads to the admin endpoint
SIEM Query:
source="web_logs" AND uri="/admin.php" AND (param="page" AND value="photo") AND (payload CONTAINS "<script>" OR payload CONTAINS "javascript:")