CVE-2024-21725: Joomla! XSS Vulnerability

CVE-2024-21725 Overview

CVE-2024-21725 is a cross-site scripting (XSS) vulnerability in Joomla! caused by inadequate escaping of mail addresses in various components. The flaw affects how the platform renders email address outputs across multiple Joomla core components. An attacker can inject malicious script content that executes in a victim's browser when the crafted mail address is rendered. Successful exploitation requires user interaction and can result in session data disclosure and unauthorized actions within the Joomla application context. The vulnerability is tracked as [CWE-79] and disclosed in Joomla Security Advisory #928.

Critical Impact
The EPSS score of 32.21% (98.22 percentile) indicates a high probability of exploitation activity relative to the broader CVE population, despite no confirmed CISA KEV listing.

Affected Products

Joomla! CMS multiple versions prior to the February 2024 security release
Joomla core components that output mail addresses
Third-party extensions relying on affected core mail output helpers

Discovery Timeline

2024-02-04 - Joomla publishes Security Advisory #928
2024-02-29 - CVE-2024-21725 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21725

Vulnerability Analysis

The vulnerability stems from insufficient output encoding of email address values across several Joomla core components. When a mail address containing HTML or JavaScript payloads is rendered, the affected components fail to escape special characters. This allows script content to be interpreted as executable markup in a victim's browser session.

The issue is classified as reflected and stored cross-site scripting depending on where the mail address value is processed. Because email fields are frequently accepted from user submissions, contact forms, and profile data, the attack surface spans both authenticated and unauthenticated flows. Exploitation requires a target to view a page rendering the crafted address.

The scope change indicated by the attack vector reflects that injected script executes in a browser context distinct from the vulnerable Joomla component, enabling impact against administrative sessions when an admin views the payload.

Root Cause

The root cause is missing or inadequate HTML escaping in the mail address output helpers used across Joomla components. Input values pass through rendering pipelines without being normalized against the HTML output context, allowing attacker-controlled markup to reach the DOM intact.

Attack Vector

An attacker submits an email address value containing HTML or JavaScript through any input surface that feeds a vulnerable output component. When a user or administrator loads a page that renders the value, the script executes with the privileges of the viewing session. This can be used to steal session tokens, perform actions on behalf of the user, or pivot to further attacks against the Joomla administrator interface. See the Joomla Security Advisory #928 for the affected version ranges.

Detection Methods for CVE-2024-21725

Indicators of Compromise

Unexpected <script>, onerror, or onload substrings stored in user profile email fields, contact form submissions, or subscriber records
Web server access logs showing HTTP requests with URL-encoded HTML payloads targeted at Joomla contact, user, or mailto endpoints
Administrator sessions terminated or exhibiting unauthorized configuration changes shortly after viewing content containing user-submitted email addresses

Detection Strategies

Query the Joomla database users, contact_details, and subscriber tables for email fields containing angle brackets, quotes, or JavaScript event handlers
Enable web application firewall rules that flag HTML markup or script tokens embedded in email form parameters
Correlate administrative account activity with page renders that include user-controlled mail address data

Monitoring Recommendations

Monitor Joomla administrator login events and subsequent configuration changes for anomalies
Log Content Security Policy (CSP) violation reports from the Joomla frontend and backend to catch script injection attempts
Track HTTP requests to index.php?option=com_contact and related components for payloads containing markup characters

How to Mitigate CVE-2024-21725

Immediate Actions Required

Upgrade Joomla! to the version identified as remediated in Joomla Security Advisory #928
Audit stored email address fields in the Joomla database for injected HTML or script content and remediate any tainted records
Rotate administrator credentials and invalidate active sessions if injected payloads are found in stored data

Patch Information

Joomla addressed the flaw in the February 2024 security release announced in Advisory #928. The fix introduces proper escaping of mail address outputs across the affected core components. Administrators should apply the update through the Joomla Update component or by deploying the official patch package from the Joomla project.

Workarounds

Deploy a web application firewall rule set that blocks HTML markup and JavaScript event handler tokens in email form parameters
Enforce a strict Content Security Policy that disallows inline scripts on Joomla frontend and administrator interfaces
Restrict administrator access to trusted networks to reduce exposure of privileged sessions to stored XSS payloads

bash

# Example CSP header to restrict inline script execution in Joomla
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"