GHSA-6qjx-787v-6pxrMediumCVSS 5.5

Craft CMS stored XSS in indexedVolumes

Published
May 26, 2023
Last Modified
November 8, 2023

🔗 CVE IDs covered (1)

CVE-2023-33197 →

📋 Description

Summary

XSS can be triggered via the Update Asset Index utility

PoC

  1. Access setting tab
  2. Create new assets
  3. In assets name inject payload: "alert(26)
  4. Click Utilities tab
  5. Choose all volumes, or volume trigger xss
  6. Click Update asset indexes.

XSS will be triggered

Json response volumes name makes triggers the payload

"session":{"id":1,"indexedVolumes":{"1":"\"<script>alert(26)</script>"},

It’s run on every POST request in the utility.

Resolved in https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766

🎯 Affected products1

  • composer/craftcms/cms:>= 4.0.0-RC1, <= 4.4.5

🔗 References (5)