GitHub Advisoryadvisory · Packagist

GHSA-cjmm-x9x9-m2w5 Craft CMS stored XSS in review volume

MEDIUM Published 2023-05-26 Modified 2023-05-26 Official page ↗
Aliases
CVE-2023-33196
Ecosystem
Packagist
Packages
craftcms/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-79, CWE-80
Reviewed
2023-05-26

Affected packages

• Packagist craftcms/cms: >= 4.0.0-RC1, < 4.4.7 → fixed in 4.4.7

Description

Summary XSS can be triggered by review volumes PoC 1. Access setting tab 2. Create new assets 3. In assets name inject payload: "alert(1337) 4. Click Utilities tab 5. Choose all volumes, or volume trigger xss 6. Click Update asset indexes. 7. Wait to assets update success. 8. Progress complete. 9. Click on review button will trigger XSS Root cause Function: index.php?p=admin/actions/asset-indexes/process-indexing-session&v=1680710595770 After loading completed, progess will load: "skippedEntries" and "missingEntries" These parameters is not yet filtered, I just tried "skippedEntries" but I think it will be work with "missingEntries" My reponse: { "session": { "id": 10, "indexedVolumes": { "6": "\"alert(1337)" }, "totalEntries": 2235, "processedEntries": 2235, "cacheRemoteImages": true, "listEmptyFolders": false, "isCli": false, "actionRequired": true, "dateCreated": "Apr 5, 2023, 9:03:16 AM", "skippedEntries": [ "\"alert(1337)/assetpreviews/Image.php", "\"alert(1337)/assetpreviews/Pdf.php" ], "missingEntries": { "folders": [], "files": [] }, "processIfRootEmpty": false }, "skipDialog": false } Resolved in https://github.com/craftcms/cms/commit/053d7119697e480ff81c5723bb9a33eaa49e0fc7

Related

Alias · CVE (1)

  • CVE-2023-33196 Craft is a CMS for creating custom digital experiences. vulnerability

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References