CVE-2024-46879: Tiki Wiki CMS Reflected XSS Vulnerability

CVE-2024-46879 Overview

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the POST request data zipPath parameter of tiki-admin_system.php in Tiki version 21.2. This vulnerability allows attackers to execute arbitrary JavaScript code via a crafted payload, leading to potential access to sensitive information or unauthorized actions within the context of an authenticated user's session.

Critical Impact

Attackers can execute arbitrary JavaScript in the context of authenticated administrator sessions, potentially leading to session hijacking, credential theft, or unauthorized administrative actions within the Tiki CMS platform.

Affected Products

• Tiki CMS version 21.2
• Tiki 21.x LTS branch (prior to security update)

Discovery Timeline

• 2026-03-23 - CVE-2024-46879 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2024-46879

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw exists in the administrative system management interface of Tiki CMS, specifically within the tiki-admin_system.php file.

The vulnerability occurs when user-supplied input through the zipPath POST parameter is reflected back to the user without proper sanitization or encoding. When an administrator interacts with a malicious link or form that targets this endpoint, the attacker-controlled JavaScript payload executes within the administrator's browser context.

This is a reflected XSS vulnerability, meaning the malicious script is not stored on the server but is instead reflected off the web application to the victim's browser. The attack requires user interaction—specifically, an authenticated administrator must be tricked into submitting a crafted request.

Root Cause

The root cause of this vulnerability is insufficient input validation and output encoding in the tiki-admin_system.php file. The zipPath parameter value is incorporated into the HTTP response without proper HTML entity encoding or other sanitization measures. This allows special characters used in JavaScript payloads (such as <, >, ", and ') to be interpreted as code rather than data.

Attack Vector

The attack vector is network-based and requires low privileges (authenticated user) combined with user interaction. An attacker would typically craft a malicious URL or form containing a JavaScript payload in the zipPath parameter. Through social engineering techniques such as phishing emails or malicious links, the attacker tricks an authenticated Tiki CMS administrator into clicking the link or submitting the form.

Once the administrator interacts with the malicious content, the JavaScript payload executes in their browser with the same privileges as the administrator session. This could allow the attacker to steal session cookies, perform actions on behalf of the administrator, modify page content, or redirect the user to malicious sites.

The attack can be delivered through various channels including:

• Phishing emails containing malicious links
• Compromised websites hosting malicious forms
• Social media messages with crafted URLs
• Forum posts or comments containing the malicious payload

Detection Methods for CVE-2024-46879

Indicators of Compromise

• Unusual HTTP POST requests to tiki-admin_system.php containing script tags or JavaScript event handlers in the zipPath parameter
• Web server logs showing encoded JavaScript payloads (e.g., %3Cscript%3E, %22onclick%3D) targeting the admin system endpoint
• Reports from users of unexpected behavior or pop-ups when accessing Tiki administrative functions
• Session anomalies indicating potential session hijacking following administrative access

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block requests containing XSS payloads in POST parameters targeting tiki-admin_system.php
• Configure intrusion detection systems to alert on patterns matching common XSS attack signatures in HTTP traffic to Tiki CMS installations
• Enable detailed access logging for administrative endpoints and regularly review for suspicious parameter values
• Deploy browser-based XSS detection solutions that can identify reflected content containing active scripts

Monitoring Recommendations

• Monitor web server access logs for requests to tiki-admin_system.php with unusual or encoded parameter values
• Set up alerts for high volumes of requests to administrative endpoints from unfamiliar IP addresses
• Implement Content Security Policy (CSP) violation reporting to detect attempted script injection
• Track and investigate any reports of phishing attempts targeting Tiki CMS administrators

How to Mitigate CVE-2024-46879

Immediate Actions Required

• Upgrade Tiki CMS to the latest patched version as recommended in the Tiki Security Update Advisory
• Restrict access to administrative endpoints like tiki-admin_system.php to trusted IP addresses only
• Educate administrators about the risks of clicking links from untrusted sources
• Review administrative session logs for any suspicious activity that may indicate prior exploitation

Patch Information

Tiki has released a security update addressing this vulnerability for the 21.x LTS branch. Administrators should upgrade to the latest available version immediately. Details about the security update can be found in the Tiki Security Update Advisory and the Tiki Newsletter Update.

A proof-of-concept for this vulnerability is available at the GitHub PoC Repository, which security teams can reference for understanding the attack mechanics and validating their mitigations.

Workarounds

• Implement a Web Application Firewall (WAF) with XSS filtering rules to sanitize malicious input before it reaches the application
• Configure network-level access controls to limit administrative interface access to known trusted IP addresses or VPN connections only
• Enable and enforce Content Security Policy (CSP) headers to prevent inline script execution
• Consider temporarily disabling or renaming tiki-admin_system.php if the functionality is not immediately required until patches can be applied

# Example Apache .htaccess configuration to restrict admin access
<Files "tiki-admin_system.php">
    Require ip 192.168.1.0/24
    Require ip 10.0.0.0/8
</Files>

# Example Content Security Policy header
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';"