CVE-2020-15249: Stored XSS in october/backend
Summary
CVE-2020-15249: Stored XSS by authenticated backend user with access to upload files. Affects october/backend versions >= 1.0.319, < 1.0.469. Fixed in 1.0.469. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The october/backend package is a part of the October CMS, an open-source content management system built on the Laravel framework. It provides the backend functionality for managing website content, including user authentication, file uploads, and resource management.
Vulnerability Detail
The vulnerability identified as CVE-2020-15249 is a stored cross-site scripting (XSS) vulnerability. It allowed authenticated backend users with file upload access to upload SVG files without proper sanitization. Since SVG files can be parsed as HTML by browsers, an attacker could potentially upload malicious JavaScript code that would be executed when a user visits a specific path under the website's domain. However, it is important to note that the backend does not display SVGs inline, limiting the potential for exploitation.
How To Fix
Minimum fixed version
1.0.469
This is the first release that contains the fix.
composer require october/backend:1.0.469Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If unable to upgrade to the patched versions or apply the manual fix, there is no specific workaround mentioned for this vulnerability.
Conclusion
The stored XSS vulnerability in the october/backend package allowed authenticated backend users to upload potentially malicious SVG files. However, the limited display of SVG files in the backend mitigates the risk of exploitation. It is recommended to upgrade to the patched versions or apply the manual fix to ensure the security of the October CMS installation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for october/backend →
FAQ
The impact of this vulnerability is limited as the backend does not display SVG files inline. An attacker would need to convince a target user to visit a specific location containing the malicious SVG file for the JavaScript code to be executed.
The vulnerability was reported by Hoan Hoang.
Versions 1.0.319 to 1.0.468 of the october/backend package are affected.
There are no known exploits for this vulnerability at the time of this advisory.
Yes, the CVSS score for this vulnerability is 2.8 (Low).
References
Related vulnerabilities
Recent vulnerabilities recorded for october/backend.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
