CVE-2024-25411

Vulnerability

A cross-site scripting (XSS) vulnerability exists in Flatpress v1.3 (affected versions include 1.2.1 and up to before the fix in 1.3). The flaw resides in the setup.php file, specifically in the username parameter of the installation wizard. When an attacker provides a malicious payload in the username field, the application reflects it back without proper sanitization or encoding, allowing arbitrary HTML or JavaScript to be executed in the context of the victim's browser [1].

Exploitation

An attacker can exploit this vulnerability remotely without any prior authentication, as the setup page is accessible before a admin account is fully configured. The attack requires the victim to visit the setup.php page while the installer is active. By entering a payload such as tes""> into the username field and clicking "Next", the script executes immediately, demonstrating arbitrary code execution [1].

Impact

Successful exploitation leads to arbitrary web script or HTML execution in the browser of any user who accesses the compromised setup page. This can result in session hijacking, defacement, or redirection to malicious sites. The impact is limited to the browser context and does not directly compromise the server, but it could be used to steal sensitive information or perform actions on behalf of the victim [1].

Mitigation

The vulnerability has been addressed in Pull Request #261, which introduces input sanitization and multilingual error messages [2]. The fix is expected to be included in Flatpress version 1.3 (the latest version at the time of reporting). Users should update to version 1.3 or apply the patch from the referenced pull request. As a workaround, administrators can restrict access to the setup.php page or disable the installer after initial configuration [2].