CVE-2024-26481: Kirby CMS URL Field Self Cross-Site Scripting Vulnerability
Summary
CVE-2024-26481: Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field. Affects getkirby/cms across 6 version ranges.
< 3.6.6.5
>= 3.7.0, < 3.7.5.4
>= 3.8.0, < 3.8.4.3
>= 3.9.0, < 3.9.8.1
>= 3.10.0, < 3.10.0.1
>= 4.0.0, < 4.1.1
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kirby CMS is an open-source content management system that allows users to create and manage websites. It provides various features and functionalities, including the URL field, which allows users to enter and validate URLs. However, prior to version 3.6.6.5, 3.7.5.4, 3.8.4.3, 3.9.8.1, 3.10.0.1, and 4.1.1, Kirby CMS was vulnerable to a self cross-site scripting (self-XSS) vulnerability in the URL field.
Vulnerability Detail
The self-XSS vulnerability in Kirby CMS allows an attacker to execute malicious JavaScript code within the context of a user's session. This can occur when a user is tricked into pasting and executing malicious code into the browser's developer console, address bar, or form fields. In the case of the URL field, an attacker could abuse the lack of URL validation and sanitization to execute arbitrary JavaScript code when the link button is clicked with Ctrl+Click/Cmd+Click. This vulnerability could lead to unauthorized access, privilege escalation, and other JavaScript-powered attacks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.6.6.53.6.6.5composer require getkirby/cms:3.6.6.5 -
>= 3.7.0, < 3.7.5.43.7.5.4composer require getkirby/cms:3.7.5.4 -
>= 3.8.0, < 3.8.4.33.8.4.3composer require getkirby/cms:3.8.4.3 -
>= 3.9.0, < 3.9.8.13.9.8.1composer require getkirby/cms:3.9.8.1 -
>= 3.10.0, < 3.10.0.13.10.0.1composer require getkirby/cms:3.10.0.1 -
>= 4.0.0, < 4.1.14.1.1composer require getkirby/cms:4.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched versions mentioned above to mitigate the risk.
Conclusion
The self-XSS vulnerability in Kirby CMS URL field poses a risk of executing malicious JavaScript code within a user's session. To mitigate this vulnerability, it is crucial to update Kirby CMS to the patched versions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for getkirby/cms →
FAQ
The vulnerability allows an attacker to execute malicious JavaScript code within a user's session, potentially leading to unauthorized access, privilege escalation, and other JavaScript-powered attacks. However, the attack is limited to self-XSS and cannot directly affect other users or visitors of the site.
An attacker can exploit this vulnerability by tricking a user with access to the Kirby CMS Panel into pasting and executing malicious JavaScript code in the URL field. The attacker would need knowledge of the content structure and rely on social engineering techniques to convince the user to execute the code.
No, the vulnerability cannot be automated. A successful attack requires knowledge of the content structure by the attacker as well as social engineering of a user with access to the Panel.
Yes, the vulnerability has been patched in Kirby CMS versions 3.6.6.5, 3.7.5.4, 3.8.4.3, 3.9.8.1, 3.10.0.1, and 4.1.1. It is recommended to update to one of these versions or a later version to fix the vulnerability.
The vulnerability was responsibly reported by Natwara Archeepsamooth (@PlyNatwara).
Related vulnerabilities
Recent vulnerabilities recorded for getkirby/cms.
