CVE-2024-4023: Flatpress Stored XSS Vulnerability

CVE-2024-4023 Overview

CVE-2024-4023 is a stored cross-site scripting (XSS) vulnerability in FlatPress version 1.3, an open-source blogging platform maintained by flatpressblog. The flaw exists in the file upload functionality, which fails to restrict files with the .xsig extension. When an authenticated user uploads a .xsig file, the server returns it with a Content-Type: application/octet-stream header. Browsers process the file as HTML, executing any embedded JavaScript in the origin of the FlatPress site. The issue is tracked as [CWE-79] and impacts confidentiality and availability.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser to steal session cookies, issue same-origin HTTP requests, and access authenticated content within the FlatPress application.

Affected Products

FlatPress 1.3
FlatPress blog platform installations exposing the admin/panels/uploader endpoint
Deployments without the upstream commit 3c9cc69 applied

Discovery Timeline

2025-03-20 - CVE-2024-4023 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4023

Vulnerability Analysis

The vulnerability resides in the FlatPress uploader panel at admin/panels/uploader/admin.uploader.php. The upload allowlist does not include the .xsig extension, but the file type is not blocked either. When accessed directly through a URL, the web server serves the uploaded .xsig file with a generic application/octet-stream MIME type. Browsers apply MIME sniffing and interpret the content as HTML, executing any <script> tags contained within.

Exploitation requires authenticated access to the uploader but no elevated privileges. A victim who clicks a link to the malicious upload executes attacker-controlled JavaScript in the FlatPress origin, exposing session cookies and administrative actions to the attacker.

Root Cause

The root cause is missing extension validation combined with unsafe content delivery. The uploader's allowlist array omitted the .xsig extension, and the server did not enforce a safe Content-Type or Content-Disposition: attachment header for uncommon file types. This allows HTML content to be smuggled into the site under an attacker-controlled filename.

Attack Vector

The attack is network-based and requires user interaction. An authenticated attacker uploads a crafted .xsig file containing HTML and JavaScript. The attacker then distributes the direct URL to victims. When a victim opens the link, the browser renders the file as HTML and executes the payload in the context of the FlatPress domain.

php

// Security patch in admin/panels/uploader/admin.uploader.php
// Adds 'xsig' to the restricted extension list
 			'svg',
 			'xml',
 			'md',
-			'pages'
+			'pages',
+			'xsig'
 		);
 
 		$imgs = array(

Source: FlatPress commit 3c9cc69

Detection Methods for CVE-2024-4023

Indicators of Compromise

Files with the .xsig extension present under the FlatPress fp-content/attachs/ directory
Web access logs showing direct GET requests to uploaded .xsig files
Outbound requests from client browsers to attacker-controlled domains shortly after visiting a FlatPress URL
HTTP responses from FlatPress serving user-uploaded content with Content-Type: application/octet-stream

Detection Strategies

Inspect FlatPress upload directories for files with extensions outside the intended media allowlist, especially .xsig, .svg, .html, and .xml.
Review web server logs for POST requests to admin/panels/uploader/ followed by GET requests to unusual file types.
Deploy a web application firewall (WAF) rule to detect script tags in uploaded file bodies.

Monitoring Recommendations

Alert on any file upload event where the extension is not on an approved media allowlist.
Monitor administrative session activity for anomalous cookie usage or session reuse from multiple IP addresses.
Track browser telemetry for unexpected script execution on FlatPress-hosted pages.

How to Mitigate CVE-2024-4023

Immediate Actions Required

Update FlatPress to a build that includes commit 3c9cc69364a45fd3f92d4bd606344b5dd1205d6a, which blocks .xsig uploads.
Audit the fp-content/attachs/ directory and remove any unexpected .xsig files.
Rotate administrative session cookies and passwords if suspicious uploads are found.
Restrict access to the FlatPress admin panel to trusted networks or authenticated administrators only.

Patch Information

The upstream fix is available in the FlatPress repository as commit 3c9cc69, which appends xsig to the list of blocked upload extensions in admin/panels/uploader/admin.uploader.php. Administrators should pull the latest FlatPress release from the FlatPress GitHub repository. Additional context is provided in the Huntr bounty report.

Workarounds

Configure the web server to serve files from the FlatPress upload directory with Content-Disposition: attachment to force download instead of rendering.
Enforce a strict Content-Security-Policy header disallowing inline scripts on FlatPress domains.
Block direct HTTP access to the uploads folder for file extensions outside a documented media allowlist.

bash

# Apache: force download for files under the FlatPress upload directory
<Directory "/var/www/flatpress/fp-content/attachs">
    Header set Content-Disposition "attachment"
    Header set X-Content-Type-Options "nosniff"
    <FilesMatch "\.(xsig|svg|xml|html?|js)$">
        Require all denied
    </FilesMatch>
</Directory>