CVE-2023-52084: Winter CMS Stored XSS through Backend ColorPicker FormWidget
Summary
CVE-2023-52084: Winter CMS Stored XSS through Backend ColorPicker FormWidget. Affects winter/wn-backend-module versions < 1.2.4. Fixed in 1.2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Winter CMS is an open-source content management system built on the Laravel framework. It provides a user-friendly interface for managing website content and customizing themes. The Winter CMS backend includes various form widgets that allow users to input and manipulate data. One such widget is the ColorPicker FormWidget, which enables users to select colors for different elements. However, a vulnerability has been discovered in Winter CMS versions prior to 1.2.4 that allows for stored cross-site scripting (XSS) attacks through the Backend ColorPicker FormWidget.
Vulnerability Detail
The vulnerability arises when a user with access to backend forms, such as the Brand Settings or Theme Customization forms, provides a malicious value through the ColorPicker FormWidget. This value is then rendered unescaped in the backend form, potentially allowing for the execution of arbitrary JavaScript code. An attacker would need trusted access to the Winter CMS backend and would have to convince a user with higher privileges to visit an affected form. While the severity of this vulnerability is relatively low, it is still recommended to update to Winter CMS version 1.2.4 to mitigate the risk.
How To Fix
Minimum fixed version
1.2.4
This is the first release that contains the fix.
composer require winter/wn-backend-module:1.2.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 1.2.4 is not immediately feasible, users can manually apply the patch provided in the Winter CMS GitHub repository. The patch can be found at the following URL: https://github.com/wintercms/winter/commit/517f65dfae679b57575b047de13c5af48915a5ba. By applying this patch, the vulnerability can be mitigated until a proper update can be performed.
Conclusion
Winter CMS versions prior to 1.2.4 are vulnerable to a stored XSS attack through the Backend ColorPicker FormWidget. While the severity of this vulnerability is relatively low, it is still recommended to update to Winter CMS version 1.2.4 or later to ensure system security. Users can also manually apply the provided patch if immediate upgrading is not feasible. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for winter/wn-backend-module →
FAQ
Winter CMS is an open-source content management system based on the Laravel framework. It provides a user-friendly interface for managing website content and customizing themes.
The ColorPicker FormWidget is a form input widget in Winter CMS that allows users to select colors for various elements. It is commonly used in backend forms for branding and theme customization.
The vulnerability occurs when a user with backend access provides a malicious value through the ColorPicker FormWidget. This value is then rendered unescaped in the backend form, potentially allowing for the execution of arbitrary JavaScript code.
The impact of this vulnerability is relatively low, as it requires an attacker to have trusted access to the Winter CMS backend and convince a user with higher privileges to visit an affected form. However, it is still recommended to update to the latest version to ensure system security.
To fix the vulnerability, Winter CMS users should update their installations to version 1.2.4 or later. This update includes a patch that addresses the issue and prevents the rendering of unescaped user input in backend forms.
References
Related vulnerabilities
Recent vulnerabilities recorded for winter/wn-backend-module.
