ghsa-2f2w-349x-vrqm
Vulnerability from github
Published
2021-07-02 19:18
Modified
2023-04-14 19:24
Severity ?
7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Summary
Cross-site scripting (XSS) from field and configuration text displayed in the Panel
Details

On Saturday, @hdodov reported that the Panel's ListItem component (used in the pages and files section for example) displayed HTML in page titles as it is. This could be used for cross-site scripting (XSS) attacks.

We used his report as an opportunity to find and fix XSS issues related to dynamic site content throughout the Panel codebase.

Impact

Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the Panel session of other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim.

Such vulnerabilities are critical if you might have potential attackers in your group of authenticated Panel users. They can escalate their privileges if they get access to the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible.

Visitors without Panel access can only use this attack vector if your site allows changing site data from a frontend form (for example user self-registration or the creation of pages from a contact or other frontend form). If you validate or sanitize the provided form data, you are already protected against such attacks by external visitors.

Patches

Kirby 3.5.7 contains patches for the following issues we found during our investigation:

  • Some translated error and info messages contain placeholders to dynamically insert information like page titles or filenames. While the translation strings are allowed to contain HTML formatting, the dynamic data needs to be protected against XSS attacks. Kirby 3.5.7 now escapes the dynamic data.
  • Our Box component used to display information for the user supports HTML output for specific use-cases. We found out that the dialogs used in the files, pages and users fields as well as the fields section used it to display raw exception or error messages. These messages are now escaped.
  • The users and settings views display user and language data using the ListItem component that supports HTML. We now escape the dynamic data before it is passed to the ListItem component.
  • Some of our sections and fields support HTML for their text, help and/or info properties. This allows custom formatting from the blueprint, but also caused the original issue reported to us that allowed to inject HTML code from the content itself. Kirby 3.5.7 now escapes the default text displayed by the files and pages sections (filename/page title), the files, pages and users fields (filename/page title/username) and by query-based checkboxes, radio, tags and multiselect fields (default text depending on the used query).

Note: Custom text, help and info queries in blueprints are not escaped in 3.5.7. We support HTML in these properties because there are valid use-cases for custom formatting. However there can still be XSS vulnerabilities depending on your use of these properties. In Kirby 3.6 we will provide a new feature that will make it much easier to control whether you want to allow HTML from query placeholders.

Show details on source website

To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.5.6"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "getkirby/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.5.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-32735"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-07-02T16:38:10Z",
    "nvd_published_at": "2021-07-02T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "On Saturday, @hdodov reported that the Panel\u0027s `ListItem` component (used in the pages and files section for example) displayed HTML in page titles as it is. This could be used for cross-site scripting (XSS) attacks.\n\nWe used his report as an opportunity to find and fix XSS issues related to dynamic site content throughout the Panel codebase.\n\n### Impact\n\nCross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the Panel session of other users. In the Panel, a harmful script can for example trigger requests to Kirby\u0027s API with the permissions of the victim.\n\nSuch vulnerabilities are critical if you might have potential attackers in your group of authenticated Panel users. They can escalate their privileges if they get access to the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible.\n\nVisitors without Panel access can only use this attack vector if your site allows changing site data from a frontend form (for example user self-registration or the creation of pages from a contact or other frontend form). If you validate or sanitize the provided form data, you are already protected against such attacks by external visitors.\n\n### Patches\n\n[Kirby 3.5.7](https://github.com/getkirby/kirby/releases/tag/3.5.7) contains patches for the following issues we found during our investigation:\n\n- Some translated error and info messages contain placeholders to dynamically insert information like page titles or filenames. While the translation strings are allowed to contain HTML formatting, the dynamic data needs to be\u00a0protected against XSS attacks. Kirby 3.5.7 now escapes the dynamic data.\n- Our `Box` component used to display information for the user supports HTML output for specific use-cases. We found out that the dialogs used in the `files`, `pages` and `users` fields as well as the `fields` section used it to display raw exception or error messages. These messages are now escaped.\n- The users and settings views display user and language data using the `ListItem` component that supports HTML. We now escape the dynamic data before it is passed to the `ListItem` component.\n- Some of our sections and fields support HTML for their `text`, `help` and/or `info` properties. This allows custom formatting from the blueprint, but also caused the original issue reported to us that allowed to inject HTML code from the content itself. Kirby 3.5.7 now escapes the default `text` displayed by the `files` and `pages` sections (filename/page title), the `files`, `pages` and `users` fields (filename/page title/username) and by query-based `checkboxes`, `radio`, `tags` and `multiselect` fields (default text depending on the used query).\n\n**Note:** Custom `text`, `help` and `info` queries in blueprints are *not* escaped in 3.5.7. We support HTML in these properties because there are valid use-cases for custom formatting. However there can still be XSS vulnerabilities depending on your use of these properties. In Kirby 3.6 we will provide a new feature that will make it much easier to control whether you want to allow HTML from query placeholders.",
  "id": "GHSA-2f2w-349x-vrqm",
  "modified": "2023-04-14T19:24:30Z",
  "published": "2021-07-02T19:18:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-2f2w-349x-vrqm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32735"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getkirby/kirby/commit/f5ead62f8510158bed5baf58ca0e851875778a09"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getkirby/kirby"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getkirby/kirby/releases/tag/3.5.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cross-site scripting (XSS) from field and configuration text displayed in the Panel"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.