CVE-2024-47617: Sulu CMS XSS Vulnerability

CVE-2024-47617 Overview

CVE-2024-47617 is a Reflected Cross-Site Scripting (XSS) vulnerability in Sulu, an open-source PHP content management system. The flaw resides in the SuluMediaBundle component, specifically in how the media download endpoint reflects the requested file name (slug) back to the client in an error response. An attacker can craft a malicious URL that injects arbitrary HTML or JavaScript into the response, executing in the victim's browser when clicked. The issue is tracked as [CWE-79] and is fixed in versions 2.6.5 and 2.5.21.

Critical Impact
Successful exploitation enables session theft, credential harvesting, defacement, or actions performed on behalf of an authenticated Sulu user.

Affected Products

Sulu CMS versions up to and including 2.5.20
Sulu CMS versions up to and including 2.6.4
SuluMediaBundle component (MediaStreamController)

Discovery Timeline

2024-10-03 - CVE-2024-47617 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47617

Vulnerability Analysis

The vulnerability exists in the downloadAction method of MediaStreamController.php within the Sulu Media Bundle. When a user requests a media download, the controller compares the URL-supplied slug against the stored fileVersion name. If they do not match, the controller returns a 404 response that embeds the attacker-controlled slug directly into the HTML body without output encoding.

Because the reflected value is rendered as HTML in the browser, an attacker can inject <script> payloads or event handlers. Exploitation requires user interaction (UI:R), typically via a phishing link. The scope change (S:C) reflects that the injected script executes in the origin of the Sulu application, allowing access to authenticated session cookies and DOM content.

Root Cause

The root cause is missing output encoding of user-supplied input in an error message path. The slug value from the request URI is concatenated into an HTML response string without sanitization or escaping, violating standard web output-encoding practice for [CWE-79] Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation is network-based and does not require authentication. An attacker crafts a URL pointing to a valid media ID with a malicious slug segment containing HTML or JavaScript. When a victim clicks the link, Sulu returns a 404 page that renders the injected payload in the victim's browser.

php

// Vulnerable behavior (pre-patch) in MediaStreamController::downloadAction
if ($fileVersion->getName() !== $slug) {
    return new Response('Invalid file name "' . $slug . '" for media with ID "' . $id . '".', 404);
}

// Patched behavior — the reflected slug is removed from the response body
if ($fileVersion->getName() !== $slug) {
    return new Response('Invalid file name for media with ID "' . $id . '".', 404);
}

Source: GitHub Commit eeacd14

Detection Methods for CVE-2024-47617

Indicators of Compromise

HTTP requests to /media/{id}/download/{slug} where the slug path segment contains HTML metacharacters such as <, >, ", or URL-encoded equivalents (%3C, %3E).
404 responses from the Sulu media stream endpoint whose response body contains reflected <script> tags or JavaScript event handlers.
Referer headers from external domains pointing to crafted Sulu media download URLs.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the slug path segment of media download URLs for XSS payload signatures.
Review Sulu application access logs for anomalous media download URIs with encoded script fragments or unusually long path components.
Correlate 404 responses from MediaStreamController with suspicious client-side behavior such as unexpected outbound requests from admin sessions.

Monitoring Recommendations

Enable verbose HTTP access logging on the Sulu web tier and forward logs to a centralized analytics platform for retention and search.
Monitor Content Security Policy (CSP) violation reports for inline script execution originating from the media download path.
Alert on repeated 404 responses from a single source IP against /media/*/download/* endpoints, indicating payload probing.

How to Mitigate CVE-2024-47617

Immediate Actions Required

Upgrade Sulu to version 2.6.5 or 2.5.21 immediately.
Inventory all Sulu deployments and confirm the running version against the fixed release list.
Rotate active administrator sessions and credentials if suspicious media download traffic is observed in logs.

Patch Information

The fix is delivered in commits a5a5ae5 and eeacd14. The first commit enforces direct route matching for media download URLs by adding an explicit $slug parameter to downloadAction. The second commit removes the user-controlled slug from the reflected 404 response body. Full details are documented in the GitHub Security Advisory GHSA-6784-9c82-vr85.

Workarounds

If immediate upgrade is not possible, place a reverse proxy or WAF rule in front of Sulu that rejects requests to /media/*/download/* containing HTML metacharacters in the slug segment.
Enforce a strict Content Security Policy that disallows inline script execution to blunt payload impact.
Restrict access to the Sulu admin interface to trusted networks and require multi-factor authentication for editorial users.

bash

# Composer upgrade example for Sulu 2.6.x
composer require sulu/sulu:^2.6.5 --update-with-dependencies

# Verify installed version
composer show sulu/sulu | grep versions