CVE-2024-33101: ThinkSAAS Stored XSS Vulnerability

CVE-2024-33101 Overview

CVE-2024-33101 is a stored cross-site scripting (XSS) vulnerability in ThinkSAAS v3.7.0. The flaw resides in the /action/anti.php component, where the word parameter fails to sanitize user-supplied input. Attackers can inject crafted payloads that persist server-side and execute arbitrary web scripts or HTML in the browsers of subsequent visitors.

The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation. Exploitation requires user interaction but no authentication, and the stored nature of the payload widens the potential victim pool across sessions.

Critical Impact
Successful exploitation enables session hijacking, credential theft, and unauthorized actions performed under the identity of authenticated ThinkSAAS users.

Affected Products

ThinkSAAS v3.7.0
ThinkSAAS component /action/anti.php
Deployments accepting untrusted input via the word parameter

Discovery Timeline

2024-04-30 - CVE-2024-33101 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-33101

Vulnerability Analysis

The vulnerability exists in the ThinkSAAS content management platform, an open-source PHP-based SaaS framework. The /action/anti.php endpoint accepts a word parameter that is stored in the application's data layer without proper output encoding or input sanitization.

When the stored value is later rendered in a response page, the payload executes in the context of the victim's browser session. This allows an attacker to run JavaScript within the trust boundary of the ThinkSAAS domain. The scope-changed CVSS vector reflects that the injected script can affect resources beyond the vulnerable component itself.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The application does not apply HTML entity encoding, contextual output escaping, or a Content Security Policy sufficient to block inline script execution on the affected page.

Attack Vector

Exploitation follows a standard stored XSS pattern. The attacker submits a crafted HTML or JavaScript payload through the word parameter to /action/anti.php. The server persists the payload, and subsequent requests that render the stored data trigger execution in the victim's browser. User interaction is required to visit the affected page, but no privileges are needed to plant the payload.

A typical payload leverages an inline <script> tag or an event handler on an HTML element. Once triggered, the script can read document.cookie, exfiltrate session tokens, or issue authenticated requests on behalf of the victim. Refer to the ThinkSAAS GitHub Issue #34 for the original report.

Detection Methods for CVE-2024-33101

Indicators of Compromise

HTTP POST requests to /action/anti.php containing <script>, onerror=, onload=, or javascript: substrings in the word parameter.
Outbound requests from client browsers to unfamiliar domains immediately after rendering ThinkSAAS pages.
Unexpected session token reuse from geographically distant IP addresses following visits to affected pages.

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects the word parameter on /action/anti.php for HTML tags and JavaScript event handlers.
Review database records for stored fields associated with the anti action that contain HTML markup or encoded script payloads.
Correlate web server access logs with response bodies to identify pages returning attacker-controlled markup.

Monitoring Recommendations

Enable verbose HTTP request logging on the ThinkSAAS reverse proxy or web server to capture parameter values.
Monitor Content Security Policy violation reports if CSP is deployed in report-only mode.
Alert on anomalous outbound traffic from user browsers accessing ThinkSAAS-hosted pages.

How to Mitigate CVE-2024-33101

Immediate Actions Required

Restrict access to /action/anti.php at the web server or WAF layer until a patched version is deployed.
Audit stored records for previously injected payloads and sanitize or purge malicious content.
Force session invalidation for users who may have interacted with compromised pages.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Track remediation status through the ThinkSAAS GitHub Issue #34 and upgrade as soon as a fixed release becomes available.

Workarounds

Implement server-side input validation that rejects HTML metacharacters in the word parameter.
Apply contextual output encoding to all fields rendered from the anti action data store.
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Place ThinkSAAS behind a WAF with signatures for stored XSS payload patterns.

bash

# Example nginx rule to block obvious XSS payloads in the word parameter
location = /action/anti.php {
    if ($arg_word ~* "(<script|onerror=|onload=|javascript:)") {
        return 403;
    }
    proxy_pass http://thinksaas_backend;
}