CVE-2021-32671: XSS vulnerability in Flarum's translation system
Summary
CVE-2021-32671: XSS vulnerability with translator. Affects flarum/core versions >= 1.0.0, < 1.0.2. Fixed in 1.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flarum is an open-source forum software that allows users to create and manage online communities. It provides features such as discussion threads, user profiles, and administration panels. The translation system in Flarum allows for the localization of the forum interface by converting string inputs into HTML DOM nodes when rendered. This feature was introduced after version v0.1.0-beta.16 and was not initially identified as a potential security risk.
Vulnerability Detail
The XSS vulnerability in Flarum's translation system allowed users to inject malicious HTML markup into certain user input fields. This markup would then be executed on client browsers, potentially leading to unauthorized actions. For example, an attacker could enter a script tag containing malicious code, such as <script>alert('test')</script>, which would trigger an alert box on the forum. This vulnerability could be further exploited to perform AJAX requests on behalf of users, enabling actions like deleting discussions, modifying settings or profiles, and even tampering with the Admin panel for privileged users.
How To Fix
Minimum fixed version
1.0.2
This is the first release that contains the fix.
composer require flarum/core:1.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
Flarum's translation system was found to have an XSS vulnerability that allowed for the execution of malicious code on client browsers. This vulnerability has been fixed in the latest release, flarum/core v1.0.2. Flarum communities running v1.0.0 or v1.0.1 should upgrade to v1.0.2 as soon as possible to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for flarum/core →
FAQ
All Flarum communities running v1.0.0 or v1.0.1 are impacted.
The vulnerability allows for unauthorized execution of malicious code on client browsers, which could result in various actions such as deleting discussions, modifying settings or profiles, and tampering with the Admin panel for privileged users.
Yes, the vulnerability has been fixed in the latest release, flarum/core v1.0.2.
To upgrade to the fixed version, run the command 'composer update --prefer-dist --no-dev -a -W' and confirm the version using 'composer show flarum/core'.
No, there are no known workarounds for this vulnerability. Upgrading to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for flarum/core.
