auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped

中 6.1CVE-2024-45592 · GHSA-78vg-7v27-hj67 · 10/09/2024 公開 · 17/06/2026 更新

要点

CVE-2024-45592 は damienharper/auditor-bundle, auditor-bundle (damienharper) に影響する深刻度「中」 (CVSS 6.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.45%（全脆弱性の 39.0% より高い）。
対処：5.2.6 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
damienharper/auditor-bundle Packagist	`< 5.2.6`	`5.2.6`
auditor-bundle damienharper	`≥ 5.0.0, < 5.2.6`	`5.2.6`

概要

Summary

Unescaped entity property enables Javascript injection.

Details

I think this is possible because %source_label% in twig macro is not escaped. Therefore script tags can be inserted and are executed.

PoC

clone example project https://github.com/DamienHarper/auditor-bundle-demo
create author with FullName <script>alert()</script>
delete author
view audit of authors
alert is displayed

Impact

persistent XSS. JS can be injected and executed.

NVD の説明

auditor-bundle, formerly known as DoctrineAuditBundle, integrates auditor library into any Symfony 3.4+ application. Prior to version 5.2.6, there is an unescaped entity property enabling Javascript injection. This is possible because `%source_label%` in twig macro is not escaped. Therefore script tags can be inserted and are executed. The vulnerability is fixed in versions 6.0.0 and 5.2.6.