GHSA-VQXQ-HVXW-9MV9

Vulnerability from github – Published: 2024-02-01 20:51 – Updated: 2024-02-14 21:30
VLAI?
Summary
Statmic CMS vulnerable to account takeover via XSS and password reset link
Details

Impact

HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS.

This affects:

  • front-end forms with asset fields without any mime type validation
  • asset fields in the control panel
  • asset browser in the control panel

Additionally, if the XSS is crafted in a specific way, the "copy password reset link" feature may be exploited to gain access to a user's password reset token and gain access to their account. The authorized user is required to execute the XSS in order for the vulnerability to occur.

Patches

In versions 4.46.0 and 3.4.17, the XSS vulnerability has been patched, and the copy password reset link functionality has been disabled. (Users may still trigger password reset emails.)

Credits

Statamic thanks Niklas Schilling (discovery, analysis, coordination) from the SEC Consult Vulnerability Lab (https://www.sec-consult.com/) for responsibly reporting the identified issues and working with us as we addressed them.

Severity ?
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "statamic/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.00"
            },
            {
              "fixed": "4.46.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "statamic/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.4.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-24570"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-01T20:51:46Z",
    "nvd_published_at": "2024-02-01T17:15:11Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nHTML files crafted to look like jpg files are able to be uploaded, allowing for XSS.\n\nThis affects:\n\n- front-end forms with asset fields without any mime type validation\n- asset fields in the control panel\n- asset browser in the control panel\n\nAdditionally, if the XSS is crafted in a specific way, the \"copy password reset link\" feature may be exploited to gain access to a user\u0027s password reset token and gain access to their account. The authorized user is required to execute the XSS in order for the vulnerability to occur.\n\n### Patches\n\nIn versions 4.46.0 and 3.4.17, the XSS vulnerability has been patched, and the copy password reset link functionality has been disabled. (Users may still trigger password reset emails.)\n\n### Credits\n\nStatamic thanks Niklas Schilling (discovery, analysis, coordination) from the SEC Consult Vulnerability Lab (https://www.sec-consult.com/) for responsibly reporting the identified issues and working with us as we addressed them.",
  "id": "GHSA-vqxq-hvxw-9mv9",
  "modified": "2024-02-14T21:30:15Z",
  "published": "2024-02-01T20:51:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/statamic/cms/security/advisories/GHSA-vqxq-hvxw-9mv9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24570"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/statamic/cms"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/177133/Statamic-CMS-Cross-Site-Scripting.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/Feb/17"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Statmic CMS vulnerable to account takeover via XSS and password reset link"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.