CVE-2023-54361: Joomla iProperty Real Estate XSS Flaw

CVE-2023-54361 Overview

CVE-2023-54361 is a reflected cross-site scripting (XSS) vulnerability affecting Joomla iProperty Real Estate version 4.1.1. The vulnerability exists in the filter_keyword parameter of the all-properties-with-map endpoint, which fails to properly sanitize user-supplied input before reflecting it back in the HTTP response. Attackers can craft malicious URLs containing JavaScript payloads that execute arbitrary code in victim browsers when clicked, potentially leading to session token theft or credential harvesting.

Critical Impact

Attackers can exploit this reflected XSS vulnerability to steal session tokens, harvest user credentials, or perform actions on behalf of authenticated users visiting malicious links.

Affected Products

• Joomla iProperty Real Estate 4.1.1
• Joomla CMS installations with iProperty Real Estate extension

Discovery Timeline

• 2026-04-09 - CVE CVE-2023-54361 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2023-54361

Vulnerability Analysis

This reflected XSS vulnerability (CWE-79) occurs when user-controlled input passed through the filter_keyword GET parameter is improperly handled by the iProperty Real Estate extension. The vulnerability is network-accessible and requires user interaction—specifically, a victim must click a crafted malicious link for the attack to succeed. The attack enables code execution within the context of the victim's browser session on the vulnerable Joomla site.

The vulnerability allows attackers to inject arbitrary JavaScript that executes when the page renders the unsanitized filter_keyword value. This can be leveraged for various malicious purposes including stealing authentication cookies, redirecting users to phishing pages, or performing unauthorized actions with the victim's privileges.

Root Cause

The root cause of this vulnerability is insufficient input validation and output encoding in the iProperty Real Estate extension. The filter_keyword parameter value is reflected in the page output without proper HTML entity encoding or script tag filtering. When user input containing JavaScript code is passed through this parameter, the browser interprets and executes the malicious script as part of the legitimate page content.

Attack Vector

The attack vector is network-based, requiring the attacker to craft a malicious URL targeting the all-properties-with-map endpoint with a JavaScript payload embedded in the filter_keyword GET parameter. The attacker must then convince a victim to click the malicious link through social engineering techniques such as phishing emails, forum posts, or other communication channels.

When a victim clicks the crafted URL, their browser requests the page from the vulnerable Joomla site. The server reflects the malicious filter_keyword value in the response without sanitization, causing the victim's browser to execute the attacker's JavaScript code within the security context of the vulnerable domain.

The vulnerability mechanism involves unsanitized reflection of the filter_keyword parameter value in the page response. Attackers construct URLs where this parameter contains JavaScript code, such as script tags or event handlers, which execute when the page loads in the victim's browser. For detailed technical exploitation information, refer to the Exploit-DB #51640 entry and the Vulncheck Joomla Advisory.

Detection Methods for CVE-2023-54361

Indicators of Compromise

• Unusual URL patterns in web server access logs containing filter_keyword parameters with encoded JavaScript payloads
• HTTP GET requests to all-properties-with-map endpoints containing <script>, javascript:, or encoded variants like %3Cscript%3E
• Web Application Firewall (WAF) alerts for XSS pattern matches on the iProperty extension endpoints
• User reports of unexpected browser behavior or redirects when accessing property listing pages

Detection Strategies

• Deploy WAF rules to detect and block XSS patterns in the filter_keyword parameter
• Implement content security policy (CSP) headers to restrict script execution sources
• Monitor server logs for requests containing common XSS payloads targeting property search endpoints
• Utilize browser-based XSS auditors and security extensions to identify reflected content

Monitoring Recommendations

• Enable detailed access logging for all Joomla extension endpoints
• Configure SIEM alerts for patterns matching encoded script tags in URL parameters
• Implement real-time log analysis to detect potential XSS exploitation attempts
• Review referrer logs for suspicious external domains directing traffic to property listing pages

How to Mitigate CVE-2023-54361

Immediate Actions Required

• Update the iProperty Real Estate extension to the latest available version if a patch has been released
• Implement input validation on the filter_keyword parameter at the application level
• Deploy Web Application Firewall rules to filter XSS payloads targeting this endpoint
• Enable Content Security Policy headers to mitigate the impact of successful XSS attacks

Patch Information

No official patch information is available in the current CVE data. Organizations should monitor the Joomla Extensions Directory and The Thinkery for security updates. Until a patch is available, implementing workarounds and WAF rules is strongly recommended.

Workarounds

• Block or sanitize requests containing suspicious characters in the filter_keyword parameter using WAF rules or mod_security
• Implement server-side input validation to strip or encode HTML special characters from the filter_keyword parameter
• Consider temporarily disabling the property search functionality if the risk is unacceptable for your environment
• Add Content-Security-Policy headers to restrict inline script execution: Content-Security-Policy: script-src 'self'

# Apache mod_security rule to block XSS in filter_keyword parameter
SecRule ARGS:filter_keyword "@rx (?i)(<script|javascript:|on\w+=)" \
    "id:100001,phase:2,deny,status:403,msg:'XSS attempt blocked in filter_keyword'"

# Add CSP header in Apache configuration
Header set Content-Security-Policy "script-src 'self'; object-src 'none'"