GHSA-7M8G-FPRR-47FX

Vulnerability from github – Published: 2024-02-05 20:22 – Updated: 2024-02-05 23:08
VLAI?
Summary
phpMyFAQ vulnerable to stored XSS on attachments filename
Details

Summary

Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leading to allow execute JavaScript code in client side (XSS)

Details

On that snippet code of rendering the file attachments from user tables

<?php foreach ($crumbs as $item) : ?>
        <tr id="attachment_<?= $item->id ?>" title="<?= $item->thema ?>">
          <td><?= $item->id ?></td>
          <td><?= $item->filename ?></td>
          <td><?= $item->record_lang ?></td>
          <td><?= Utils::formatBytes($item->filesize) ?></td>
          <td><?= $item->mime_type ?></td>
          <td>

The data directly rendering with short hand echo without any sanitation first, its recommend to use existing class of Strings::htmlentities on use phpMyFAQ\Strings;

<td><?= Strings::htmlentities($item->filename); ?></td>
<td><?= Strings::htmlentities($item->record_lang); ?></td>
<td><?= Utils::formatBytes($item->filesize) ?></td>
<td><?= Strings::htmlentities($item->mime_type); ?></td>

Propose fixing on that pull request https://github.com/thorsten/phpMyFAQ/pull/2827

PoC

  1. An attacker with permission will upload the attachments image on http://{base_url}/admin/?action=editentry
  2. On endpoint of ajax upload image POST /admin/index.php?action=ajax&ajax=att&ajaxaction=upload
  3. Change the originally name file on parameters filename to a XSS payload

  4. The XSS will trigger on attachment pages /admin/?action=attachments

  5. Trigger XSS image

  6. Payload XSS image

Impact

This vulnerability will allow an attacker with a permissions of uploading an attachment to storing the payload of XSS on database specific table faqattachment columns filename.

The XSS payload could be rendering on page that listing the file on tables, and impact to others user that on the hierarchy.

The payload XSS have several attack scenario such like

  1. Stealing the cookies (isn’t possible since HttpOnly)
  2. Crashing the application with a looping javascript payload
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "phpmyfaq/phpmyfaq"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-24574"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-05T20:22:05Z",
    "nvd_published_at": "2024-02-05T21:15:12Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nUnsafe echo of filename in phpMyFAQ\\phpmyfaq\\admin\\attachments.php leading to allow execute JavaScript code in client side (XSS)\n\n### Details\nOn that snippet code of rendering the file attachments from user tables\n\n```\n\u003c?php foreach ($crumbs as $item) : ?\u003e\n        \u003ctr id=\"attachment_\u003c?= $item-\u003eid ?\u003e\" title=\"\u003c?= $item-\u003ethema ?\u003e\"\u003e\n          \u003ctd\u003e\u003c?= $item-\u003eid ?\u003e\u003c/td\u003e\n          \u003ctd\u003e\u003c?= $item-\u003efilename ?\u003e\u003c/td\u003e\n          \u003ctd\u003e\u003c?= $item-\u003erecord_lang ?\u003e\u003c/td\u003e\n          \u003ctd\u003e\u003c?= Utils::formatBytes($item-\u003efilesize) ?\u003e\u003c/td\u003e\n          \u003ctd\u003e\u003c?= $item-\u003emime_type ?\u003e\u003c/td\u003e\n          \u003ctd\u003e\n```\n\nThe data directly rendering with short hand echo without any sanitation first, its recommend to use  existing class of `Strings::htmlentities` on use `phpMyFAQ\\Strings;`\n\n```\n\u003ctd\u003e\u003c?= Strings::htmlentities($item-\u003efilename); ?\u003e\u003c/td\u003e\n\u003ctd\u003e\u003c?= Strings::htmlentities($item-\u003erecord_lang); ?\u003e\u003c/td\u003e\n\u003ctd\u003e\u003c?= Utils::formatBytes($item-\u003efilesize) ?\u003e\u003c/td\u003e\n\u003ctd\u003e\u003c?= Strings::htmlentities($item-\u003emime_type); ?\u003e\u003c/td\u003e\n```\n\nPropose fixing on that pull request https://github.com/thorsten/phpMyFAQ/pull/2827\n\n### PoC\n1. An attacker with permission will upload the attachments image on [http://{base_url}/admin/?action=editentry](http://{base_url}/admin/?action=editentry)\n2. On endpoint of ajax upload image POST /admin/index.php?action=ajax\u0026ajax=att\u0026ajaxaction=upload \n3. Change the originally name file on parameters  filename to a XSS payload \n4. The XSS will trigger on attachment pages /admin/?action=attachments\n\n- Trigger XSS\n![image](https://user-images.githubusercontent.com/37658579/301022211-81da265b-5dce-48bd-a043-8bae0991fe46.png)\n\n- Payload XSS\n\u003cimg width=\"1000\" alt=\"image\" src=\"https://user-images.githubusercontent.com/37658579/301022571-d6cdd166-b1f9-4062-87c5-c8bbb308cd5d.png\"\u003e\n\n\n\n\n### Impact\n\nThis vulnerability will allow an attacker with a permissions of uploading an attachment to storing the payload of XSS on database specific table `faqattachment` columns `filename.`\n\nThe XSS payload could be rendering on page that listing the file on tables, and impact to others user that on the hierarchy. \n\nThe payload XSS have several attack scenario such like \n\n1. Stealing the cookies (isn\u2019t possible since HttpOnly)\n2. Crashing the application with a looping javascript payload\n",
  "id": "GHSA-7m8g-fprr-47fx",
  "modified": "2024-02-05T23:08:13Z",
  "published": "2024-02-05T20:22:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7m8g-fprr-47fx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24574"
    },
    {
      "type": "WEB",
      "url": "https://github.com/thorsten/phpMyFAQ/pull/2827"
    },
    {
      "type": "WEB",
      "url": "https://github.com/thorsten/phpMyFAQ/commit/5479b4a4603cce71aa7eb4437f1c201153a1f1f5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/thorsten/phpMyFAQ"
    },
    {
      "type": "WEB",
      "url": "https://www.phpmyfaq.de/security/advisory-2024-02-05"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "phpMyFAQ vulnerable to stored XSS on attachments filename"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.