CVE-2024-28190: Contao Core Bundle - Cross Site Scripting in the File Manager
Summary
CVE-2024-28190: Contao: Cross site scripting in the file manager. Affects contao/core-bundle across 2 version ranges.
>= 4.0.0, < 4.13.40
>= 5.0.0-RC1, < 5.3.4
Fixed in 4.13.40 or 5.3.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Contao Core Bundle is a popular open-source content management system (CMS) used for creating and managing websites. It provides a range of features including file management, user authentication, and content editing. The File Manager component allows users to upload and manage files within the CMS backend.
Vulnerability Detail
A cross-site scripting (XSS) vulnerability has been discovered in the File Manager of Contao Core Bundle. This vulnerability allows users to upload files with malicious code embedded in the file names. When these files are accessed, the malicious code is executed in tooltips and popups in the backend. An attacker could exploit this vulnerability to perform various malicious actions, such as stealing sensitive information or executing arbitrary code.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0, < 4.13.404.13.40composer require contao/core-bundle:4.13.40 -
>= 5.0.0-RC1, < 5.3.45.3.4composer require contao/core-bundle:5.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advised to disable file uploads for untrusted users. By restricting file upload privileges, the risk of malicious code execution can be mitigated. This can be achieved by modifying the user permissions in the Contao backend.
Conclusion
The cross-site scripting vulnerability in the Contao Core Bundle File Manager poses a moderate risk to websites using Contao as their CMS. It is crucial to update to Contao 4.13.40 or Contao 5.3.4 to mitigate the risk of malicious code execution. Additionally, disabling file uploads for untrusted users can provide temporary protection. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for contao/core-bundle →
FAQ
The vulnerability allows attackers to execute malicious code in tooltips and popups in the Contao backend, potentially leading to unauthorized access, data theft, or arbitrary code execution.
You can use the Vulert Playground at Vulert Scanner to check if your Contao installation is affected by this vulnerability. Simply upload your composer.lock file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is important to apply the recommended patches or workarounds to prevent potential exploitation.
While manual sanitization of file names can help mitigate the risk, it is not a foolproof solution. It is recommended to apply the official patches or upgrade to the latest version of Contao to ensure comprehensive protection against this vulnerability.
This vulnerability was reported by Alexander Wuttke. The Contao project acknowledges his contribution in identifying and reporting this security issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/core-bundle.
