GHSA-w998-qmw9-mf4m REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

• Packagist redaxo/source: < 5.21.2 → fixed in 5.21.2

Summary The mediapool sync page (`sync.php`) renders filenames from the `/media` filesystem directory directly into HTML without applying `rex_escape()` (i.e., `htmlspecialchars`). Any file placed in the media directory whose filename contains HTML metacharacters will execute JavaScript in the browser of any backend user who views the sync page. Details In `redaxo/src/addons/mediapool/pages/sync.php`, the variable `$diffFiles` is populated from actual filesystem filenames (files in `/media/` not yet registered in the database). These filenames are then rendered without escaping: File: `redaxo/src/addons/mediapool/pages/sync.php:119-120` ```php foreach ($diffFiles as $file) { if (is_writable(rex_path::media($file))) { $e = []; $e['label'] = '' . $file . ''; // NO rex_escape! $e['field'] = ''; // NO rex_escape! $writable[] = $e; } else { $notWritable[] = $file; } } ``` File: `redaxo/src/addons/mediapool/pages/sync.php:170` ```php $fragment->setVar('body', '' . implode('', $notWritable) . '', false); // $notWritable contains unescaped filenames ``` By contrast, all other filename displays in the codebase use `rex_escape($fname)` (e.g., `media.detail.php:236`, `media.list.php`). The sync page is accessible to any backend user with the `media[sync]` permission (not exclusively admins). PoC 1. Place a file named `.txt` into the REDAXO `/media/` directory (via backup restore or server access) without adding it to the media database. 2. Log in as any backend user with `media[sync]` permission. 3. Navigate to Mediapool → Sync. 4. The XSS payload executes immediately, stealing the admin session cookie. Impact Stored XSS in the admin panel. An attacker who can place files in the media directory (via admin-level backup restore or server access) can achieve persistent XSS against all users who visit the sync page, including higher-privileged admins. This enables session hijacking, credential theft, and full CMS takeover. Fix Apply `rex_escape()` to all filename variables before inserting into HTML: ```php $e['label'] = '' . rex_escape($file) . ''; $e['field'] = ''; // ... $fragment->setVar('body', '' . implode('', array_map('rex_escape', $notWritable)) . '', false); ```