CVE-2022-24899: Cross-Site Scripting in Contao Core Bundle
Summary
CVE-2022-24899: Cross site scripting via canonical tag in Contao. Affects contao/core-bundle versions >= 4.13.0, < 4.13.3. Fixed in 4.13.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Contao Core Bundle is a package in the Packagist ecosystem that provides essential functionality for the Contao content management system. It enables the creation and management of websites with features such as user authentication, page routing, and template rendering. Unfortunately, this package is susceptible to a cross-site scripting (XSS) vulnerability.
Vulnerability Detail
The vulnerability allows untrusted users to inject malicious code into the canonical tag, which is then executed on the front end of the web page. This can lead to various security risks, including unauthorized access to sensitive information, session hijacking, and defacement of the website. The vulnerability has a CVSS score of 7.2, indicating a high severity level.
How To Fix
Minimum fixed version
4.13.3
This is the first release that contains the fix.
composer require contao/core-bundle:4.13.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to Contao 4.13.3 is not immediately feasible, a temporary workaround is to disable canonical tags in the root page settings. This can be done by accessing the Contao administration panel, navigating to the root page settings, and deselecting the option for canonical tags. However, it is crucial to update to the latest version as soon as possible to fully address the vulnerability.
Conclusion
The cross-site scripting vulnerability in Contao Core Bundle can have severe consequences, including unauthorized access and website defacement. It is crucial to update to Contao 4.13.3 or apply the temporary workaround of disabling canonical tags. For more information and assistance, please contact DevNack.com.
See every vulnerability recorded for contao/core-bundle →
FAQ
The vulnerability allows untrusted users to inject malicious code, which can lead to various security risks such as unauthorized access, session hijacking, and website defacement.
Updating to Contao 4.13.3 will fix the vulnerability. It is important to ensure that all instances of the Contao Core Bundle are updated to the latest version.
Yes, you can disable canonical tags in the root page settings as a temporary workaround. However, it is crucial to update to Contao 4.13.3 as soon as possible to fully address the vulnerability.
You can find more information about this vulnerability in the Contao security advisories at https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url
For further support on vulnerability remediation, you can reach out to info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/core-bundle.
