A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parseinistring() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APPKEY}, ${DBPASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.

Impact - Exfiltration of sensitive environment variables (APPKEY, DB credentials, AWS keys, etc.) - Could enable further attacks: database access, cookie forgery, AWS resource access - Requires authenticated backend access with Editor permissions - Only relevant when cms.safemode is enabled (otherwise direct PHP injection is already possible)

Patches The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.

Workarounds If upgrading immediately is not possible: - Restrict Editor tool access to fully trusted administrators only - Ensure database and cloud service credentials are not accessible from the web server's network

References - Reported by Proactive Testing Team (PTT)

A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.

Impact - Stored XSS via malicious SVG files uploaded through the Media Manager - Could allow privilege escalation if a superuser views or embeds the malicious SVG - Requires authenticated backend access with media upload permissions (media.library.create) - SVG must be viewed or embedded in a page to trigger

Patches The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.

Workarounds If upgrading immediately is not possible: - Disable SVG uploads by adding svg to the blocked extensions in media configuration - Set media.cleanvectors to true in configuration (enabled by default)

References - Reported by Offensive Security Research Team

October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator accounts which had previously been deleted may still be able to sign in to the backend using October CMS v2.0. The issue has been patched in v2.1.12 of the october/october package. There are no workarounds for this issue and all users should update.

Impact When logging out, the session ID was not invalidated. This is not a problem while the user is logged out, but as soon as the user logs back in the old session ID would be valid again; which means that anyone that gained access to the old session cookie would be able to act as the logged in user. This is not a major concern for the majority of cases, since it requires a malicious party gaining access to the session cookie in the first place, but nevertheless has been fixed.

Patches Issue has been patched in Build 472 (v1.0.472) and v1.1.2.

Workarounds Apply https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024 to your installation manually if unable to upgrade to Build 472 or v1.1.2.

References - Reported by Anisio (Brazilian Information Security Analyst) - http://cve.circl.lu/cve/CVE-2021-3311

For more information If you have any questions or comments about this advisory: Email us at hello@octobercms.com

Threat assessment: <img width="699" alt="Screen Shot 2021-02-07 at 11 50 35 PM" src="https://user-images.githubusercontent.com/7253840/107180881-51eaf000-699f-11eb-8828-333128faf2a6.png">

Impact

An attacker can request an account password reset and then gain access to the account using a specially crafted request.

- To exploit this vulnerability, an attacker must know the username of an administrator and have access to the password reset form.

Patches

- Issue has been patched in Build 472 and v1.1.5 - Shortened patch instructions

Workarounds

Apply https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374 and https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9 to your installation manually if you are unable to upgrade.

[Update 2022-01-20] Shortened patch instructions can be found here.

Recommendations

We recommend the following steps to make sure your server stays secure:

- Keep server OS and system software up to date. - Keep October CMS software up to date. - Use a multi-factor authentication plugin. - Change the default backend URL or block public access to the backend area. - Include the Roave/SecurityAdvisories Composer package to ensure that your application doesn't have installed dependencies with known security vulnerabilities.

References

Bugs found as part of Solar Security CMS Research. Credits to: • Andrey Basarygin • Andrey Guzei • Mikhail Khramenkov • Alexander Sidukov • Maxim Teplykh

For more information If you have any questions or comments about this advisory: Email us at hello@octobercms.com

October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page.

A stored cross-site scripting (XSS) vulnerability was identified in the Event Log mail preview feature. When viewing logged mail messages, HTML content was rendered in an iframe without proper sandboxing, allowing JavaScript execution in the viewer's browser context.

Impact - Stored XSS via mail template content rendered in Event Log - Could allow privilege escalation if a superuser views a malicious log entry - Requires authenticated backend access with mail template editing permissions - Requires a superuser to view the specific Event Log entry to trigger

Patches The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.

Workarounds If upgrading immediately is not possible: - Restrict mail template editing permissions to fully trusted administrators only - Restrict Event Log viewing permissions to minimize exposure

References - Reported by Chris Alupului

A stored cross-site scripting (XSS) vulnerability was identified in the Backend Editor Settings. The Markup Classes fields (used for paragraph styles, inline styles, table styles, etc.) did not sanitize input to valid CSS class name characters. Malicious values were rendered unsanitized in Froala editor dropdown menus, allowing JavaScript execution when any user opened a RichEditor.

Impact - Stored XSS via editor settings rendered in RichEditor dropdowns - Could allow privilege escalation if a superuser opens any RichEditor (e.g., editing a blog post) - Requires authenticated backend access with editor settings permissions - Triggers on routine content editing operations

Patches The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.

Workarounds If upgrading immediately is not possible: - Restrict editor settings permissions to fully trusted administrators only

References - Reported by Chris Alupului

A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMSSAFEMODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.

Impact - Bypass of Twig sandbox restrictions - Only affects installations with CMSSAFEMODE enabled (disabled by default) - Requires authenticated backend access with CMS template editing permissions

Patches The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.

Workarounds If upgrading immediately is not possible: - Disable CMSSAFEMODE if untrusted template editing is not required - Restrict CMS template editing permissions to fully trusted administrators only

References - Reported by Łukasz Rybak

A cross-site scripting (XSS) vulnerabilities was identified in October CMS backend configuration forms:

- Editor Settings Markup Styles A user with the Global Editor Settings permission could inject malicious HTML/JS into the stylesheet input at Settings → Editor Settings → Markup Styles.

A specially crafted input could break out of the intended <style> context, allowing arbitrary script execution across backend pages for all users.

---

Impact - Persistent XSS across the backend interface. - Exploitable by lower-privileged accounts with the above permissions. - Potential consequences include privilege escalation, session hijacking, and execution of unauthorized actions in victim sessions.

---

Patches The vulnerability has been patched in v4.0.12 and v3.7.13. Stylesheet inputs are now sanitized to prevent injection of arbitrary HTML/JS.

All users are strongly encouraged to upgrade to the latest patched version.

---

Workarounds If upgrading immediately is not possible: - Restrict the permissions Global Editor Settings to fully trusted administrators only.

This reduces exposure but does not fully eliminate risk.

---

Credits - Reported by Nakkouch Tarek

A cross-site scripting (XSS) vulnerabilities was identified in October CMS backend configuration forms:

- Branding and Appearances Styles A user with the Customize Backend Styles permission could inject malicious HTML/JS into the stylesheet input at Settings → Branding & Appearance → Styles.

A specially crafted input could break out of the intended <style> context, allowing arbitrary script execution across backend pages for all users.

---

Impact - Persistent XSS across the backend interface. - Exploitable by lower-privileged accounts with the above permissions. - Potential consequences include privilege escalation, session hijacking, and execution of unauthorized actions in victim sessions.

---

Patches The vulnerability has been patched in v4.0.12 and v3.7.13. Stylesheet inputs are now sanitized to prevent injection of arbitrary HTML/JS.

All users are strongly encouraged to upgrade to the latest patched version.

---

Workarounds If upgrading immediately is not possible: - Restrict the permissions Customize Backend Styles to fully trusted administrators only.

This reduces exposure but does not fully eliminate risk.

---

Credits - Reported by Nakkouch Tarek

October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system. If the file is accessed through the website, it could lead to a Cross-Site Scripting (XSS) attack or execute arbitrary code via a crafted JavaScript to the target.

Impact

The X-October-Request-Handler Header does not sanitize the AJAX handler name and allows unescaped HTML to be reflected back. There is no impact since this vulnerability cannot be exploited through normal browser interactions. This unescaped value is only detectable when using a proxy interception tool.

Patches

This issue has been patched in v3.5.15.

References

Credits to: - Mayank Mehra

For more information If you have any questions or comments about this advisory: Email us at hello@octobercms.com

Impact

This advisory affects authenticated administrators with sites that have the media.cleanvectors configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This vulnerability allows an authenticated user to bypass this protection by uploading it with a permitted extension (for example, .jpg or .png) and later modifying it to the .svg extension.

This vulnerability assumes a trusted user will attack another trusted user and cannot be actively exploited without access to the administration panel and interaction from the other user.

Patches

This issue has been patched in v3.7.5.

References

Credits to: - Cyber-Wo0dy

For more information If you have any questions or comments about this advisory: Email us at hello@octobercms.com

Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3

Impact

A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported.

SVG files are supported by default in v3 for convenience; however, this has resulted in multiple mistaken vulnerability reports from security researchers. As per the documentation, if a backend user is not trusted, the advice is to remove the svg extension from the list of supported file types.

Patches

The issue has been patched in v3.5.2 by including an SVG sanister. It is enabled by default for new installations but must be enabled for existing sites in the config/media.php file.

'cleanvectors' => true,

Workarounds

If you cannot upgrade for this patch, follow the pervious advice and remove svg from the supported file types.

References

- https://github.com/octobercms/october/blob/3.x/config/media.php

Credits to: - Faris Krivic - Okan Kurtulus - Aldin Visnjic - Bug Shankar

For more information If you have any questions or comments about this advisory: Email us at hello@octobercms.com

Impact When running on servers that are configured to accept a wildcard as a hostname (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. See the following resources for more information on Host Header Poisoning: - https://portswigger.net/web-security/host-header - https://dzone.com/articles/what-is-a-host-header-attack

Patches

A feature has been added in v1.1.2 to allow a set of trusted hosts to be specified in the application.

Workarounds

- Apply https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6 & https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0 to your installation manually if unable to upgrade to v1.1.2.

- Check that the configuration setting cms.linkPolicy is set to force.

Alternative Workaround

Check to make sure that your web server does not accept any hostname when serving your web application.

1. Add an entry called testing.tld to your computer's host file and direct it to your server's IP address 2. Open the address testing.tld in your web browser 3. Make sure an October CMS website is not available at this address

If an October CMS website is returned, configure your webserver to only allow known hostnames. If you require assistance with this, please contact your server administrator.

References

Reported by Abdullah Hussam

For More Information

If you have any questions or comments about this advisory: Email us at hello@octobercms.com

Threat Assessment <img width="1108" alt="Screen Shot 2021-01-15 at 4 12 57 PM" src="https://user-images.githubusercontent.com/7253840/104783859-92fb3600-574c-11eb-9e21-c0dc05d230a9.png">

A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via a crafted payload into the Comments section.

October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with "create, modify and delete website pages" privileges in the backend is able to execute PHP code by running specially crafted Twig code in the template markup. The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.

Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass cms.safemode / cms.enableSafeMode in order to execute arbitrary code. This issue only affects admin panels that rely on safe mode and restricted permissions. To exploit this vulnerability, an attacker must first have access to the backend area. The issue has been patched in Build 474 (v1.0.474) and v1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually.

Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advised to upgrade their installations to build 474 or v1.1.10. The only known workaround is to manually apply the patch (e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a) which adds server signature validation.

October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the fromData method, an unauthenticated user can perform remote code execution (RCE) by exploiting a race condition in the temporary storage directory. This vulnerability affects plugins that expose the October\Rain\Database\Attach\File::fromData as a public interface and does not affect vanilla installations of October CMS since this method is not exposed or used by the system internally or externally. The issue has been patched in Build 476 (v1.0.476), v1.1.12, and v2.2.15. Those who are unable to upgrade may apply with patch to their installation manually as a workaround.

October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin panel and permission to open the "Editor" section, they can bypass the Safe Mode (cms.safemode) restriction to introduce new PHP code in a CMS template using a specially crafted request. The issue has been patched in versions 2.2.34 and 3.0.66.

Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account.

October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents PHP execution in the CMS templates.The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.

An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file.

Withdrawn Advisory This advisory has been withdrawn because the vulnerability affects October CMS's installer, not October CMS. The installer deletes all folders and files upon completion of installation. The vulnerability is valid, but because October's installer is not part of one of the GitHub Advisory Database's supported ecosystems, alerts cannot be sent out for the correct package.

Corrected Description A Cross-Site Scripting (XSS) vulnerability in the installer of October CMS allows an attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost field.

Impact

This advisory affects authenticated administrators who may be redirected to an untrusted URL using the PageFinder schema. The resolver for the page finder link schema (october://) allowed external links, therefore allowing an open redirect outside the scope of the active host.

This vulnerability assumes a trusted user will attack another trusted user and cannot be actively exploited without access to the administration panel and interaction from the other user.

Patches

This issue has been patched in v3.5.15.

References

Credits to: - Benzetaa

For more information If you have any questions or comments about this advisory: Email us at hello@octobercms.com

October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result in an Authenticated user with media module permission creating arbitrary folder name with XSS content. This attack appear to be exploitable via an Authenticated user with media module permission who can create arbitrary folder name (XSS). This vulnerability appears to have been fixed in build 437.

October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php (makeFileContents function) that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend path is accessible. This vulnerability appears to have been fixed in Build 437.