CVE-2024-28235: Contao/core-bundle - Possible cookie sharing with external domains while checking protected pages for broken links
Summary
CVE-2024-28235: Contao: Possible cookie sharing with external domains while checking protected pages for broken links. Affects contao/core-bundle across 2 version ranges.
>= 4.9.0, < 4.13.40
>= 5.0.0-RC1, < 5.3.4
Fixed in 4.13.40 or 5.3.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Contao/core-bundle is a package in the Packagist ecosystem that is used in the Contao content management system. It provides core functionality and features for managing and displaying content on websites. This package is vulnerable to a security issue that allows for possible cookie sharing with external domains when checking protected pages for broken links.
Vulnerability Detail
The vulnerability in Contao/core-bundle occurs when the crawler is configured to crawl protected pages. In this scenario, the crawler sends the cookie header to external URLs, potentially sharing sensitive information with those domains. This can lead to unauthorized access to protected content and compromise user privacy. The vulnerability has a CVSS score of 8.3, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.9.0, < 4.13.404.13.40composer require contao/core-bundle:4.13.40 -
>= 5.0.0-RC1, < 5.3.45.3.4composer require contao/core-bundle:5.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is possible to disable crawling protected pages. This can be done by adjusting the crawler configuration to exclude protected pages from the crawling process. However, this workaround may limit the functionality of the crawler and should only be considered as a temporary solution until the package is updated.
Conclusion
The Contao/core-bundle package is vulnerable to a security issue that allows for possible cookie sharing with external domains. To mitigate this vulnerability, it is recommended to update the package to version 4.13.40 or 5.3.4. Alternatively, you can temporarily disable crawling protected pages as a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for contao/core-bundle →
FAQ
The vulnerability allows for possible cookie sharing with external domains, which can lead to unauthorized access to protected content and compromise user privacy.
To fix this vulnerability, update the Contao/core-bundle package to version 4.13.40 or 5.3.4, depending on the version being used.
Yes, you can temporarily disable crawling protected pages as a workaround. However, this may limit the functionality of the crawler and should only be considered as a temporary solution.
You can find more information about this vulnerability in the Contao security advisories at https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler.
This vulnerability has a CVSS score of 8.3, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/core-bundle.
