CVE-2023-33196: Craft CMS stored XSS in review volume
Summary XSS can be triggered by review volumes
PoC
1. Access setting tab 2. Create new assets 3. In assets name inject payload: "<script>alert(1337)</script> 4. Click Utilities tab 5. Choose all volumes, or volume trigger xss 6. Click Update asset indexes. 7. Wait to assets update success. 8. Progress complete. 9. Click on review button will trigger XSS
Root cause Function: index.php?p=admin/actions/asset-indexes/process-indexing-session&v=1680710595770 After loading completed, progess will load: "skippedEntries" and "missingEntries" These parameters is not yet filtered, I just tried "skippedEntries" but I think it will be work with "missingEntries"
My reponse: { "session": { "id": 10, "indexedVolumes": { "6": "\"<script>alert(1337)</script>" }, "totalEntries": 2235, "processedEntries": 2235, "cacheRemoteImages": true, "listEmptyFolders": false, "isCli": false, "actionRequired": true, "dateCreated": "Apr 5, 2023, 9:03:16 AM", "skippedEntries": [ "\"<script>alert(1337)</script>/assetpreviews/Image.php", "\"<script>alert(1337)</script>/assetpreviews/Pdf.php" ], "missingEntries": { "folders": [], "files": [] }, "processIfRootEmpty": false }, "skipDialog": false }
Resolved in https://github.com/craftcms/cms/commit/053d7119697e480ff81c5723bb9a33eaa49e0fc7
Other sources
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/craftcms/cmsto a version that resolves this vulnerability.Fixed in 4.4.7 - Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 4.4.7Patch commit/053d7119697e480ff81c5723bb9a33eaa49e0fc7 - Compensating control
After applying the fix, ensure asset indexing/processing is not triggered with attacker-controlled review volumes (e.g., restrict access to the asset indexing session/process endpoint such that untrusted users cannot set or influence the review volume used for process-indexing-session).
Event History
Frequently Asked Questions
What is CVE-2023-33196?
CVE-2023-33196 refers to a vulnerability in Craft CMS that allows for cross-site scripting (XSS) attacks to be triggered.
How severe is CVE-2023-33196?
CVE-2023-33196 is rated with a severity score of 5.5, which is considered medium.
Which versions of Craft CMS are affected by CVE-2023-33196?
Craft CMS versions 4.0.0-RC1, 4.0.0-RC2, 4.0.0-RC3, and 4.0.0 to 4.4.6 are affected by CVE-2023-33196.
How can the vulnerability in CVE-2023-33196 be exploited?
The vulnerability in CVE-2023-33196 can be exploited by injecting malicious scripts into asset names and triggering the XSS attack through the update of asset indexes.
How can I mitigate the vulnerability in CVE-2023-33196?
To mitigate the vulnerability in CVE-2023-33196, it is recommended to update Craft CMS to version 4.4.7 or apply the provided fix from the official Craft CMS repository.