CVE-2020-13459: Image Resizer Cross-site Scripting (XSS) in the Bulk Resize action
Summary
CVE-2020-13459: Image Resizer Cross-site Scripting (XSS) in the Bulk Resize action. Affects verbb/image-resizer versions < 2.0.9. Fixed in 2.0.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Image Resizer plugin is a component of Craft CMS that allows users to resize images in bulk. It provides functionality to manipulate and optimize images for various purposes. The plugin is widely used and integrated into many Craft CMS websites. However, a vulnerability has been discovered in the Bulk Resize action of the plugin, which allows for stored cross-site scripting (XSS) attacks.
Vulnerability Detail
The Image Resizer plugin before version 2.0.9 for Craft CMS is susceptible to a stored XSS vulnerability in the Bulk Resize action. This means that an attacker can inject malicious code into the plugin, which will be executed when a user interacts with the affected functionality. The vulnerability arises from insufficient input validation and sanitization, allowing an attacker to store malicious scripts in the plugin's database. When a user triggers the Bulk Resize action, the stored script is executed, potentially leading to unauthorized access, data theft, or other malicious activities.
How To Fix
Minimum fixed version
2.0.9
This is the first release that contains the fix.
composer require verbb/image-resizer:2.0.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the Bulk Resize action in the Image Resizer plugin until the update is applied. This can be done by modifying the plugin's configuration or removing the affected functionality from the website. However, this workaround may limit the image resizing capabilities until the vulnerability is fully resolved.
Conclusion
The Image Resizer plugin for Craft CMS is vulnerable to a stored XSS attack in the Bulk Resize action. It is crucial for users to update the plugin to version 2.0.9 or later to mitigate the risk of unauthorized access and potential data theft. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for verbb/image-resizer →
FAQ
The vulnerability allows an attacker to execute arbitrary code on the affected Craft CMS website, potentially leading to unauthorized access, data theft, or other malicious activities.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to apply the recommended update as soon as possible to mitigate the risk.
Yes, this vulnerability can be exploited remotely. An attacker can inject the malicious script into the plugin's database, and it will be executed when a user triggers the Bulk Resize action.
No, only versions before 2.0.9 of the Image Resizer plugin for Craft CMS are affected. It is crucial to update to version 2.0.9 or later to fix the vulnerability.
If you suspect that your Craft CMS website is affected by this vulnerability, it is recommended to update the Image Resizer plugin to version 2.0.9 or later. Additionally, you can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability without any signup or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for verbb/image-resizer.
