CVE-2023-52083: Winter CMS Stored XSS through privileged upload of Media Manager file followed by renaming
Summary
CVE-2023-52083: Winter CMS Stored XSS through privileged upload of Media Manager file followed by renaming. Affects winter/wn-system-module versions < 1.2.4. Fixed in 1.2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Winter CMS is an open-source content management system (CMS) that allows users to create and manage websites. It provides various features such as media management, user permissions, and customizable themes. The Winter CMS Media Manager allows users with the media.manage_media permission to upload and manage files. However, a vulnerability in the Media Manager's file renaming functionality could lead to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability arises when a user with the media.manage_media permission uploads a file to the Media Manager and subsequently renames it. The Media Manager only sanitizes files during the upload process, not during renaming. This oversight enables an attacker with trusted permissions to upload a malicious SVG file and rename it to execute a stored XSS attack. However, it's important to note that the severity of this vulnerability is low. Exploiting the vulnerability requires the attacker to have extensive access and control within the Winter CMS backend. Additionally, the victim must directly visit the URL of the malicious SVG file, and the application must use local storage for uploaded files. Winter CMS renders SVGs through an img tag, preventing direct execution of payloads. These limitations significantly reduce the potential harm of the vulnerability.
How To Fix
Minimum fixed version
1.2.4
This is the first release that contains the fix.
composer require winter/wn-system-module:1.2.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If unable to upgrade to version 1.2.4, a temporary workaround can be applied manually. The following commits can be applied to the Winter CMS codebase:
Applying these commits will address the vulnerability by ensuring that files are properly sanitized during renaming in the Media Manager.
Conclusion
In conclusion, Winter CMS version 1.2.4 includes patches to address the stored XSS vulnerability in the Media Manager. Users are advised to update to the latest version to ensure the security of their systems. If unable to upgrade, manual application of the necessary commits can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for winter/wn-system-module →
FAQ
Winter CMS is an open-source content management system (CMS) that allows users to create and manage websites. It provides various features such as media management, user permissions, and customizable themes.
The impact of this vulnerability is low. Exploiting the vulnerability requires the attacker to have trusted permissions in the Winter CMS backend. Additionally, the victim must directly visit the URL of the malicious SVG file, and the application must use local storage for uploaded files. Winter CMS renders SVGs through an img tag, preventing direct execution of payloads.
To fix this vulnerability, it is recommended to update Winter CMS to the latest version (1.2.4). This update includes the necessary patches to sanitize files during renaming in the Media Manager. Upgrading to the latest version will ensure that systems remain secure.
If unable to upgrade to version 1.2.4, a temporary workaround can be applied manually. The necessary commits can be applied to the Winter CMS codebase to address the vulnerability.
The potential harm from this vulnerability is limited. Exploiting the vulnerability requires the attacker to have extensive access and control within the Winter CMS backend. Additionally, the victim must directly visit the URL of the malicious SVG file, and the application must use local storage for uploaded files. Winter CMS renders SVGs through an img tag, preventing direct execution of payloads.
References
Related vulnerabilities
Recent vulnerabilities recorded for winter/wn-system-module.
