CVE-2024-28235: Contao possible cookie sharing with external domains while checking protected pages for broken links
Impact
If the crawler is set to crawl protected pages, it sends the cookie header to externals URLs.
Patches
Update to Contao 4.13.40 or 5.3.4.
Workarounds
Disable crawling protected pages.
References
https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
Other sources
Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28235?
The severity of CVE-2024-28235 is significant as it involves the exposure of session cookies to external URLs when crawling protected pages.
How do I fix CVE-2024-28235?
To fix CVE-2024-28235, update to Contao version 4.13.40 or 5.3.4.
What are the potential risks associated with CVE-2024-28235?
The potential risks of CVE-2024-28235 include unauthorized access to user sessions and the potential for session hijacking.
Can I prevent CVE-2024-28235 without updating?
Yes, as a workaround, you can prevent CVE-2024-28235 by disabling crawling of protected pages.
Which versions of Contao are affected by CVE-2024-28235?
CVE-2024-28235 affects Contao versions 4.9.0 up to 4.13.40 and versions 5.0.0-RC1 up to 5.3.4.