CVE-2023-33197: Craft CMS stored XSS in indexedVolumes
Summary XSS can be triggered via the Update Asset Index utility
PoC 1. Access setting tab 2. Create new assets 3. In assets name inject payload: "<script>alert(26)</script> 4. Click Utilities tab 5. Choose all volumes, or volume trigger xss 7. Click Update asset indexes.
XSS will be triggered
Json response volumes name makes triggers the payload
"session":{"id":1,"indexedVolumes":{"1":"\"<script>alert(26)</script>"},
It’s run on every POST request in the utility.
Resolved in https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766
Other sources
Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/craftcms/cmsto a version that resolves this vulnerability.Fixed in 4.4.6 - Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 4.4.6Patch 8c2ad0bd313015b8ee42326af2848ee748f1d766
Event History
Frequently Asked Questions
What is CVE-2023-33197?
CVE-2023-33197 is a vulnerability in Craft CMS that allows cross-site scripting (XSS) attacks to be triggered via the Update Asset Index utility.
How can I exploit CVE-2023-33197?
To exploit CVE-2023-33197, you can inject a malicious script into the assets name and trigger the XSS attack by updating asset indexes.
How severe is CVE-2023-33197?
CVE-2023-33197 has a severity rating of medium with a CVSS score of 5.5.
How do I fix CVE-2023-33197?
To fix CVE-2023-33197, update your Craft CMS installation to version 4.4.6 or apply the necessary patches.
Where can I find more information about CVE-2023-33197?
You can find more information about CVE-2023-33197 on the Craft CMS GitHub page and the provided reference links.