En resumen
- CVE-2023-33197 es una vulnerabilidad MEDIO (CVSS 5.4) que afecta a craftcms/cms, craft cms (craftcms).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.68%, mayor que el 52.4% de las vulnerabilidades.
- Solución: actualizar a 4.4.6 o posterior.
| Package | Affected versions | Patched versions |
|---|
| craftcms/cms Packagist | ≥ 4.0.0-RC1, < 4.4.6
| 4.4.6
|
| craft cms | < 4.4.6
| 4.4.6
|
Description
Summary
XSS can be triggered via the Update Asset Index utility
PoC
- Access setting tab
- Create new assets
- In assets name inject payload: "<script>alert(26)</script>
- Click Utilities tab
- Choose all volumes, or volume trigger xss
- Click Update asset indexes.
XSS will be triggered
Json response volumes name makes triggers the payload
"session":{"id":1,"indexedVolumes":{"1":"\"<script>alert(26)</script>"},
It’s run on every POST request in the utility.
Resolved in https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766
NVD description
Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free