GHSA-78vg-7v27-hj67MediumCVSS 8.2

auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped

Published
September 10, 2024
Last Modified
November 18, 2024

🔗 CVE IDs covered (1)

CVE-2024-45592 →

📋 Description

Summary

Unescaped entity property enables Javascript injection.

Details

I think this is possible because %source_label% in twig macro is not escaped. Therefore script tags can be inserted and are executed.

PoC

  • clone example project https://github.com/DamienHarper/auditor-bundle-demo
  • create author with FullName alert()
  • delete author
  • view audit of authors
  • alert is displayed

Impact

persistent XSS. JS can be injected and executed.

🎯 Affected products1

  • composer/damienharper/auditor-bundle:< 5.2.6

🔗 References (5)