CVE-2024-28191: Contao Core Bundle - Unencoded insert tags in the frontend
Summary
CVE-2024-28191: Contao: Unencoded insert tags in the frontend. Affects contao/core-bundle across 2 version ranges.
>= 4.0.0, < 4.13.40
>= 5.0.0-RC1, < 5.3.4
Fixed in 4.13.40 or 5.3.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Contao Core Bundle is a package that provides essential functionality for the Contao CMS. It includes features such as form generation, data output, and content management. The package is widely used by developers to build and manage websites.
Vulnerability Detail
This vulnerability in the Contao Core Bundle allows for the injection of unencoded insert tags via the form generator. If the submitted form data is output on the page in a specific way, an attacker can exploit this to inject malicious code or manipulate the displayed content. The impact of this vulnerability can range from unauthorized data access to potential remote code execution.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0, < 4.13.404.13.40composer require contao/core-bundle:4.13.40 -
>= 5.0.0-RC1, < 5.3.45.3.4composer require contao/core-bundle:5.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the Contao Core Bundle is not immediately possible, a temporary workaround is to avoid outputting the submitted form data on the website. By preventing the display of user-submitted data, the risk of exploit is mitigated.
Conclusion
The vulnerability in the Contao Core Bundle allows for the injection of unencoded insert tags, which can lead to various security risks. It is crucial to update to the recommended versions or implement the provided workaround to ensure the secure handling of form data. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for contao/core-bundle →
FAQ
The Contao Core Bundle is a package that provides essential functionality for the Contao CMS, including form generation and data output.
The vulnerability occurs when the form generator outputs submitted form data on the page without proper encoding, allowing for the injection of unencoded insert tags.
The consequences of this vulnerability can range from unauthorized data access to potential remote code execution, depending on how the injected insert tags are utilized.
No, only versions 4.0.0 to 4.13.39 and 5.0.0-RC1 to 5.3.3 are affected. Updating to versions 4.13.40 or 5.3.4 will fix the vulnerability.
Yes, by avoiding the output of submitted form data on the website, the risk of exploit can be mitigated. However, updating to the patched versions is recommended for complete security.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/core-bundle.
