CVE-2023-7035: Stored Cross-site scripting in automad/automad
Summary
CVE-2023-7035: Withdrawn Advisory: Stored Cross-site scripting affecting automad/automad. Affects automad/automad versions < 1.10.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Automad is a package available on Packagist that provides a content management system (CMS) for creating and managing websites. It allows users to easily create and edit web pages, manage templates, and handle shared data. The vulnerability in question affects versions up to 1.10.9 of the automad/automad package.
Vulnerability Detail
The vulnerability is a stored cross-site scripting (XSS) issue that arises from the mishandling of user input in the sitename argument. The SharedController class responsible for handling form data and saving shared information fails to properly sanitize the user input on the client side when rendering the data. This allows an attacker to inject malicious scripts into the website, which can be executed when other users view the affected page. The vulnerability can be exploited remotely, and there have been public disclosures of an exploit. The severity of this vulnerability is rated as LOW with a CVSS score of 2.4.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can manually sanitize the sitename input before saving it to the database. This can be done by using appropriate sanitization functions or libraries to remove any potentially malicious scripts. Here is an example of how to sanitize the input using PHP's htmlspecialchars function:
$sitename = htmlspecialchars($_POST['sitename'], ENT_QUOTES, 'UTF-8');
By applying this workaround, the risk of the stored XSS vulnerability can be mitigated.
Conclusion
In conclusion, the automad/automad package up to version 1.10.9 is vulnerable to a stored cross-site scripting (XSS) issue. This can allow attackers to inject malicious scripts into the website, potentially leading to various security risks. To mitigate this vulnerability, it is advised to upgrade to a non-affected version of the package and follow secure coding practices. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for automad/automad →
FAQ
The vulnerability allows an attacker to inject malicious scripts into the website, which can be executed when other users view the affected page. This can lead to various consequences, such as stealing sensitive user information, performing unauthorized actions on behalf of the user, or defacing the website.
Yes, there have been public disclosures of an exploit for this vulnerability. This means that attackers are aware of the issue and may actively exploit it to compromise vulnerable websites.
Yes, the vulnerability can be exploited remotely. Attackers do not need direct access to the target system to launch an attack.
The severity of this vulnerability is rated as LOW with a CVSS score of 2.4. While the impact of successful exploitation can be significant, the conditions required for exploitation are more difficult to achieve.
To protect your website, it is crucial to update the automad/automad package to a version that includes the fix for this vulnerability. Additionally, it is recommended to follow secure coding practices and sanitize user input before rendering it on web pages.
Related vulnerabilities
Recent vulnerabilities recorded for automad/automad.
