CVE-2024-58289
📋 TL;DR
Microweber 2.0.15 contains a stored cross-site scripting vulnerability in user profile fields that allows authenticated attackers to inject malicious JavaScript. When other users view the attacker's profile, the script executes in their browser context, potentially stealing session cookies or performing unauthorized actions. This affects all Microweber installations running version 2.0.15 with user registration enabled.
💻 Affected Systems
- Microweber
📦 What is this software?
Microweber by Microweber
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full administrative access, compromise user accounts, and potentially pivot to server compromise through subsequent attacks.
Likely Case
Attackers steal user session cookies to hijack accounts, perform unauthorized actions, or deface user profiles with malicious content.
If Mitigated
Limited to authenticated users only, with potential for account compromise but restricted to user-level privileges.
🎯 Exploit Status
Exploit requires authenticated user access. Public exploit code demonstrates simple JavaScript injection in first name field.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.16 or later
Vendor Advisory: https://github.com/microweber/microweber
Restart Required: No
Instructions:
1. Backup your Microweber installation. 2. Update to Microweber 2.0.16 or later via the admin panel or manual update. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Input Sanitization
allImplement server-side input validation and output encoding for user profile fields
Modify user profile handling code to sanitize inputs using htmlspecialchars() or similar functions
Content Security Policy
allImplement strict CSP headers to prevent script execution from user inputs
Add 'Content-Security-Policy: default-src 'self'; script-src 'self'' to web server configuration
🧯 If You Can't Patch
- Disable user registration and profile editing functionality
- Implement web application firewall rules to block XSS payloads in user profile submissions
🔍 How to Verify
Check if Vulnerable:
Check if Microweber version is 2.0.15. Attempt to inject <script>alert('XSS')</script> into first name field and see if it executes when viewing profile.Check Version:
Check admin panel dashboard or view composer.json file for version informationVerify Fix Applied:
After updating, attempt the same XSS payload injection. It should be properly sanitized and not execute.📡 Detection & Monitoring
Log Indicators:
- Unusual script tags in user profile update requests
- Multiple failed login attempts followed by profile updates
Network Indicators:
- HTTP POST requests to user profile endpoints containing script tags or JavaScript code
SIEM Query:
source="web_logs" AND (uri_path="/api/user/update" OR uri_path="/user/save-profile") AND (request_body LIKE "%<script>%" OR request_body LIKE "%javascript:%")