CVE-2024-29473: Zhyd Oneblog Stored XSS Vulnerability

CVE-2024-29473 Overview

CVE-2024-29473 is a stored cross-site scripting (XSS) vulnerability in OneBlog v2.3.4, an open-source blogging platform maintained by zhyd. The flaw resides in the Role Management module, where user-supplied input is persisted without adequate output encoding. Authenticated users with access to role administration can inject JavaScript that executes in the browsers of other users who view the affected role data.

Critical Impact
Attackers can persist arbitrary JavaScript in the Role Management interface, enabling session theft, administrative action hijacking, and pivoting within the OneBlog application.

Affected Products

OneBlog (zhyd) version 2.3.4
Deployments exposing the Role Management module to untrusted role administrators
Any downstream fork of zhyd:oneblog that inherits the vulnerable module

Discovery Timeline

2024-03-20 - CVE-2024-29473 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29473

Vulnerability Analysis

The issue is a stored XSS flaw categorized under [CWE-79], improper neutralization of input during web page generation. Input submitted through the Role Management module is written to persistent storage and later rendered in the administrative UI without contextual escaping. Any subsequent visitor loading the role listing or edit view executes the attacker-controlled payload in their session context.

Exploitation requires network access to the application and a single user interaction, such as loading the affected admin page. The scope changes because injected script runs in the trust boundary of another authenticated user, allowing lateral impact beyond the attacker's own account.

Root Cause

The root cause is missing server-side sanitization and missing output encoding on role-related fields. OneBlog stores raw HTML or JavaScript submitted through role forms and reflects the values back into rendered pages. Without an allow-list filter or HTML entity encoding, <script> tags and event-handler attributes reach the DOM intact.

Attack Vector

An authenticated user with permission to create or modify roles submits a payload such as an inline script or event handler through a role field. The payload is stored in the OneBlog database. When an administrator or another privileged user opens the Role Management view, the browser parses and executes the injected code, giving the attacker access to cookies, CSRF tokens, and any action the victim can perform.

No verified public exploit code is available. Refer to the Gitee Issue Report for the vendor's original technical discussion.

Detection Methods for CVE-2024-29473

Indicators of Compromise

Role records in the OneBlog database containing <script>, onerror=, onload=, or javascript: substrings
Outbound HTTP requests from administrator browsers to unfamiliar domains after visiting /role administrative pages
Unexpected session token or cookie exfiltration events tied to OneBlog admin sessions

Detection Strategies

Inspect HTTP POST bodies to the Role Management endpoints for HTML control characters and script-like tokens
Query the roles table for stored values that fail an HTML-safe character allow-list
Enable Content Security Policy (CSP) reporting to capture blocked inline script executions in the admin UI

Monitoring Recommendations

Log all create, update, and delete operations against roles with the associated user identity and source IP
Alert on administrative account activity that immediately follows a role modification by a lower-privileged user
Review web server access logs for repeated requests to role management URLs from non-administrative accounts

How to Mitigate CVE-2024-29473

Immediate Actions Required

Restrict access to the Role Management module to a minimal set of trusted administrators
Audit existing role records for stored HTML or JavaScript and remove suspicious entries
Rotate administrator session cookies and credentials if injected payloads are found

Patch Information

No fixed version is listed in the NVD entry for CVE-2024-29473 against OneBlog v2.3.4. Track the vendor's Gitee Issue Report for remediation status and upgrade guidance. Until a patched release is confirmed, apply the workarounds below.

Workarounds

Place OneBlog behind a web application firewall (WAF) with rules that block script tags and event-handler attributes in role parameters
Enforce a strict Content Security Policy that disallows inline scripts in the admin interface
Add server-side input validation that rejects non-alphanumeric characters in role name and description fields

bash

# Example nginx header enforcing a strict CSP for the OneBlog admin console
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;