CVE-2024-25874: Enhavo CMS v0.13.1 - Cross-site Scripting Vulnerability
Summary
CVE-2024-25874: Enhavo Cross-site Scripting vulnerability. Affects enhavo/enhavo-app versions < 0.13.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Enhavo CMS is a content management system that allows users to create and manage articles. It is built on the Enhavo App package, which is available on Packagist. The New/Edit Article module in Enhavo CMS v0.13.1 is vulnerable to a cross-site scripting (XSS) attack. This vulnerability can be exploited by injecting a crafted payload into the Create Tag text field, allowing attackers to execute arbitrary web scripts or HTML.
Vulnerability Detail
The cross-site scripting (XSS) vulnerability in Enhavo CMS v0.13.1 arises from insufficient input sanitization in the Create Tag text field. Attackers can exploit this vulnerability by injecting malicious scripts or HTML code, which will be executed when the vulnerable page is viewed by other users. This can lead to various consequences, including session hijacking, defacement of the website, or theft of sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the Create Tag functionality or implement input validation and sanitization on the server-side to prevent the execution of malicious scripts or HTML. Here is an example of server-side input validation in PHP:
$input = $_POST['create_tag'];
$clean_input = strip_tags($input);
// Use $clean_input in your application
This code snippet uses the strip_tags function to remove any HTML tags from the input, effectively neutralizing the XSS vulnerability.
Conclusion
The cross-site scripting vulnerability in Enhavo CMS v0.13.1 can allow attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Create Tag text field. To mitigate this vulnerability, users should update to the latest version of Enhavo CMS and implement proper input validation and sanitization on the server-side. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for enhavo/enhavo-app →
FAQ
Enhavo CMS is a content management system that allows users to create and manage articles. It provides a user-friendly interface and various features for content editing and publishing.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts or HTML code into web pages viewed by other users. This can lead to various consequences, such as session hijacking, defacement of the website, or theft of sensitive information.
This vulnerability can be exploited by injecting a crafted payload into the Create Tag text field of Enhavo CMS. When other users view the vulnerable page, the injected payload will be executed, allowing the attacker to execute arbitrary web scripts or HTML.
The impact of this vulnerability can vary depending on the attacker's intentions. Possible consequences include session hijacking, defacement of the website, or theft of sensitive information.
To protect your Enhavo CMS installation from this vulnerability, it is recommended to update to a version that includes a patch for this issue. Additionally, implementing input validation and sanitization on the server-side can help mitigate the risk of XSS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for enhavo/enhavo-app.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
