CVE-2023-52085: Winter CMS Local File Inclusion through Server Side Template Injection
Summary
CVE-2023-52085: Winter CMS Local File Inclusion through Server Side Template Injection. Affects winter/wn-backend-module versions < 1.2.4. Fixed in 1.2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Winter CMS is an open-source content management system that allows users to create and manage websites. It provides various features and modules for backend administration, theme customization, and asset compilation. One of the functionalities offered by Winter CMS is the ColorPicker FormWidget, which allows users to select colors for different elements of their website. This widget is commonly used in backend forms and can also be included in theme customization forms. Winter CMS uses LESS (Leaner CSS) for compiling custom stylesheets, and the values provided through the ColorPicker FormWidget are used in the compilation process. However, a vulnerability in Winter CMS allows for Local File Inclusion through Server Side Template Injection when processing these values.
Vulnerability Detail
The vulnerability arises when users with access to backend forms that include the ColorPicker FormWidget provide a value that is included without further processing in the compilation of custom stylesheets via LESS. This can potentially lead to a Local File Inclusion vulnerability. By default, only the Brand Settings and Mail Brand Settings forms include the ColorPicker FormWidget and pass the provided value to be compiled in LESS. However, it is also possible for themes to include this widget in their Theme Customization form, and the values from that form can also be used in LESS compilation. An attacker could exploit this vulnerability by providing a malicious value that includes a path to a local file, resulting in the inclusion of arbitrary files on the server. This could lead to unauthorized access, information disclosure, or even remote code execution depending on the context in which the included file is used.
How To Fix
Minimum fixed version
1.2.4
This is the first release that contains the fix.
composer require winter/wn-backend-module:1.2.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to upgrade to Winter CMS version 1.2.4, you can apply the patch manually by following the steps provided in the commit mentioned earlier. Alternatively, you can remove or disable the ColorPicker FormWidget from any forms where it is not necessary. This will prevent the possibility of including malicious values in the compilation process.
Conclusion
Winter CMS version 1.2.4 includes a patch for the Local File Inclusion vulnerability through Server Side Template Injection. It is crucial to upgrade to this version or apply the patch manually to mitigate the risk of unauthorized file inclusion. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for winter/wn-backend-module →
FAQ
Winter CMS is an open-source content management system that allows users to create and manage websites. It provides various features and modules for backend administration, theme customization, and asset compilation.
The ColorPicker FormWidget is a feature in Winter CMS that allows users to select colors for different elements of their website. It is commonly used in backend forms and can also be included in theme customization forms.
The vulnerability occurs when the values provided through the ColorPicker FormWidget are included without proper validation and sanitization in the compilation of custom stylesheets via LESS. This can lead to a Local File Inclusion vulnerability, allowing an attacker to include arbitrary files on the server.
The potential consequences of this vulnerability include unauthorized access to sensitive files, information disclosure, and even remote code execution depending on the context in which the included file is used.
To mitigate the risk, it is recommended to upgrade Winter CMS to version 1.2.4 or later. If upgrading is not possible, you can apply the patch manually or remove/disable the ColorPicker FormWidget from forms where it is not necessary.
References
Related vulnerabilities
Recent vulnerabilities recorded for winter/wn-backend-module.
