CVE-2024-58297
📋 TL;DR
PyroCMS v3.0.1 contains a stored cross-site scripting vulnerability in the admin redirects configuration. Attackers can inject malicious JavaScript into the 'Redirect From' field, which executes when administrators view the redirects page. This affects all PyroCMS v3.0.1 installations with admin access.
💻 Affected Systems
- PyroCMS
📦 What is this software?
Pyrocms by Pyrocms
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform actions as administrators (including installing backdoors, modifying content, or accessing sensitive data), and potentially compromise the entire CMS installation.
Likely Case
Attackers with admin access or who can trick administrators into executing malicious actions could steal session tokens, redirect users to malicious sites, or deface the admin interface.
If Mitigated
With proper input validation and output encoding, the malicious scripts would be rendered harmless as text rather than executable code.
🎯 Exploit Status
Exploitation requires admin privileges to access the redirects configuration page. Public exploit code is available on Exploit-DB.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified
Vendor Advisory: https://pyrocms.com/
Restart Required: No
Instructions:
1. Check PyroCMS website for security updates. 2. Upgrade to a patched version if available. 3. Apply input validation and output encoding fixes to the redirects module.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement server-side validation and HTML encoding for the 'Redirect From' field to prevent script injection.
Restrict Admin Access
linuxLimit admin panel access to trusted IP addresses only using web server configuration.
# Apache: Use .htaccess with Require ip
# Nginx: Use allow/deny directives in server block
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution sources.
- Regularly audit admin activity logs for suspicious redirect modifications.
🔍 How to Verify
Check if Vulnerable:
Check if your PyroCMS version is 3.0.1 and test if the 'Redirect From' field in admin panel accepts and executes JavaScript payloads without sanitization.Check Version:
Check the version in the PyroCMS admin dashboard or examine the composer.json file for version information.Verify Fix Applied:
Test that JavaScript payloads in the 'Redirect From' field are properly encoded and do not execute when viewing the redirects page.📡 Detection & Monitoring
Log Indicators:
- Unusual modifications to redirect configurations in admin logs
- Admin session anomalies or unexpected access patterns
Network Indicators:
- Unexpected JavaScript payloads in HTTP POST requests to redirect configuration endpoints
SIEM Query:
Search for POST requests containing script tags or JavaScript code to /admin/redirects endpoints