CVE-2023-33194: CraftCMS stored XSS in Quick Post widget error message
Summary The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload.
Details Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save.
PoC 1. Login at admin 2. Go to setting 3. Create a Section 4. On Entry page, click Edit label 5. Inject the XSS payload into the label and save 6. On the admin dashboard choose new widget -> Quick Post 7. In Quick Post, click save with blank slug; The XSS will be executed
"errors":{"title":["<script>alert('nono')</script> cannot be blank."],"slug":["Slug cannot be blank."]
Fixed in https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888
Other sources
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/craftcms/cmsto a version that resolves this vulnerability.Fixed in 3.8.6 - Upgrade
Upgrade
composer/craftcms/cmsto a version that resolves this vulnerability.Fixed in 4.4.6 - Upgrade
Upgrade
craftcms/cmsto a version that resolves this vulnerability.Fixed in 4.4.6Patch 9d0cd0bda7c8a830a3373f8c0f06943e519ac888
Event History
Frequently Asked Questions
What is the vulnerability ID for this Craft CMS vulnerability?
The vulnerability ID for this Craft CMS vulnerability is CVE-2023-33194.
What is the severity of CVE-2023-33194?
The severity of CVE-2023-33194 is medium.
What is the affected version range for Craft CMS?
Craft CMS versions from 3.0.0 to 3.8.5 and from 4.0.0-RC1 to 4.4.6 are affected.
How can I fix CVE-2023-33194?
To fix CVE-2023-33194, you should update Craft CMS to version 3.8.6 or higher.
Are there any references available for more information?
Yes, you can find more information and references for CVE-2023-33194 at the following links: [GitHub Commit](https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888), [GitHub Security Advisory](https://github.com/craftcms/cms/security/advisories/GHSA-3wxg-w96j-8hq9), [Craft CMS Releases](https://github.com/craftcms/cms/releases/tag/4.4.6).