CVE-2020-4061: Cross-site Scripting in October
Summary
CVE-2020-4061: Cross-site Scripting in October. Affects october/backend versions >= 1.0.319, < 1.0.467. Fixed in 1.0.467. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
October is a content management system (CMS) built on the Laravel framework. It provides a user-friendly interface for managing website content and includes features such as a rich text editor called Froala. The Froala editor allows users to create and edit content with various formatting options. However, a vulnerability has been discovered in October that allows for cross-site scripting (XSS) attacks when pasting content copied from malicious websites into the Froala editor.
Vulnerability Detail
The vulnerability in October CMS arises from the way the Froala editor handles pasted content. When a user copies content from a malicious website and pastes it into the editor, the malicious code is executed within the user's browser, leading to a successful self-XSS attack. This can potentially allow an attacker to steal sensitive information, perform actions on behalf of the user, or manipulate the user's browsing experience. The vulnerability has been assigned a CVSS score of 3.7, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.0.467
This is the first release that contains the fix.
composer require october/backend:1.0.467Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading or applying the fix manually is not feasible, a workaround is available. The workaround involves applying the changes described in the GitHub commit mentioned earlier to the October CMS installation. This can be done by modifying the affected files as specified in the commit.
Conclusion
The vulnerability in October CMS allows for cross-site scripting (XSS) attacks when pasting content copied from malicious websites into the Froala editor. It is recommended to upgrade to Build 467 (v1.0.467) or apply the provided fix manually to mitigate the risk. There are no known instances of this vulnerability being exploited, but it is important to take preventive measures. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for october/backend →
FAQ
The vulnerability allows for self-XSS attacks, meaning it can only impact users who copy and paste content from malicious websites into the Froala editor. It does not directly affect other users visiting the website.
Yes, a patch has been released in Build 467 (v1.0.467) of October CMS. Upgrading to this version will address the vulnerability.
Yes, if upgrading is not possible, the fix can be manually applied by following the instructions provided in the GitHub commit: https://github.com/octobercms/october/commit/b384954a29b89117e1c0d6035b3ede4f46df67c5
There are no known instances of this vulnerability being exploited in the wild. However, it is still important to apply the necessary patches or workarounds to mitigate the risk.
The original issue in the Froala editor was discovered by Michał Bentkowski of Securitum. The issue was reported to the October CMS team by @tomaszstrojny.
References
Related vulnerabilities
Recent vulnerabilities recorded for october/backend.
