En bref
- CVE-2023-33197 est une vulnérabilité MOYENNE (CVSS 5.4) touchant craftcms/cms, craft cms (craftcms).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.68%, plus élevée que 52.4% des vulnérabilités.
- Correctif : mettre à jour vers 4.4.6 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| craftcms/cms Packagist | ≥ 4.0.0-RC1, < 4.4.6
| 4.4.6
|
| craft cms | < 4.4.6
| 4.4.6
|
Description
Summary
XSS can be triggered via the Update Asset Index utility
PoC
- Access setting tab
- Create new assets
- In assets name inject payload: "<script>alert(26)</script>
- Click Utilities tab
- Choose all volumes, or volume trigger xss
- Click Update asset indexes.
XSS will be triggered
Json response volumes name makes triggers the payload
"session":{"id":1,"indexedVolumes":{"1":"\"<script>alert(26)</script>"},
It’s run on every POST request in the utility.
Resolved in https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766
NVD description
Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free