CVE-2023-24230: Formwork Cross-site Scripting (XSS) from Page title field
Summary
CVE-2023-24230: Formwork Cross-site Scripting (XSS) from Page title field. Affects getformwork/formwork versions < 1.13.0. Fixed in 1.13.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Formwork is a package available on Packagist that provides a content management system (CMS) for building websites. It allows users to create and edit pages through an Administration Panel. The package is vulnerable to a stored cross-site scripting (XSS) attack, which occurs when an attacker injects malicious scripts or HTML into the Page title field. This vulnerability can be exploited by users with access to the Administration Panel and page editing permission.
Vulnerability Detail
The stored cross-site scripting (XSS) vulnerability in Formwork v1.12.1 enables attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Page title field. This means that an attacker can potentially manipulate the website's content and perform actions on behalf of authenticated users. The vulnerability has a CVSS score of 4.8, indicating a moderate severity level. It has been assigned the identifier GHSA-fvrh-wrpf-6q7h in the GitHub Security Advisory database.
How To Fix
Minimum fixed version
1.13.0
This is the first release that contains the fix.
composer require getformwork/formwork:1.13.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that only trusted individuals have access to the Administration Panel with page editing permission. Additionally, it is advisable to sanitize and validate user input to prevent the injection of malicious scripts or HTML.
Conclusion
In conclusion, the Formwork package is vulnerable to a stored cross-site scripting (XSS) attack that allows attackers to execute arbitrary web scripts or HTML. The vulnerability has been assigned the identifier GHSA-fvrh-wrpf-6q7h and has a CVSS score of 4.8. To mitigate the risk, it is crucial to update to the patched version, Formwork 1.13.0, and follow the recommended security practices. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for getformwork/formwork →
FAQ
A stored XSS vulnerability is a type of security flaw that allows an attacker to inject malicious scripts or HTML into a website's database or storage. When the vulnerable page is accessed by other users, the injected code is executed, potentially leading to unauthorized actions or data theft.
Only users with access to the Administration Panel and page editing permission can exploit this vulnerability. This means that an attacker needs to have authorized access to the Formwork CMS in order to inject the malicious payload into the Page title field.
The stored XSS vulnerability in Formwork can allow an attacker to manipulate the website's content, perform actions on behalf of authenticated users, or steal sensitive information. This can lead to unauthorized access, data breaches, and potential damage to the reputation of the affected website.
Yes, the vulnerability has been patched in Formwork version 1.13.0. It is recommended to update to this version to ensure the security of your Formwork installation.
You can find more information about the vulnerability, including the patch details and affected versions, in the GitHub Security Advisory database. The vulnerability has the identifier GHSA-fvrh-wrpf-6q7h.
Related vulnerabilities
Recent vulnerabilities recorded for getformwork/formwork.
