CVE-2024-35191: verbb/formie Server-Side Template Injection for variable-enabled settings
Summary
CVE-2024-35191: verbb/formie Server-Side Template Injection for variable-enabled settings. Affects verbb/formie versions < 2.1.6. Fixed in 2.1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
verbb/formie is a package available on Packagist that provides form building and management functionality for Craft CMS. It allows users to create and customize forms, including settings for fields such as the Submission Title and Success Message. These settings support Twig, a templating language used in Craft CMS. However, a vulnerability exists in versions prior to 2.1.6 that allows users with control panel access to inject malicious Twig code into these fields. When a submission is created or the text is rendered, this code is executed, potentially leading to unauthorized actions or data exposure. This vulnerability is considered low-medium severity as it requires control panel access to exploit.
Vulnerability Detail
The vulnerability in verbb/formie arises from the ability for users to include Twig code in form settings. This allows an attacker with control panel access to inject malicious code into fields such as the Submission Title or Success Message. When a submission is created or the text is rendered, the injected code is executed, enabling the attacker to perform unauthorized actions or expose sensitive data. The impact of this vulnerability can range from unauthorized access to the system to data leakage, depending on the specific actions performed by the injected code. The vulnerability has a CVSS score of 4.4, indicating a moderate level of severity.
How To Fix
Minimum fixed version
2.1.6
This is the first release that contains the fix.
composer require verbb/formie:2.1.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can mitigate the risk by ensuring that only trusted individuals have control panel access and by regularly monitoring form settings for any suspicious or unauthorized changes.
Conclusion
In conclusion, the verbb/formie package prior to version 2.1.6 is vulnerable to server-side template injection when variable-enabled settings are used. This allows attackers with control panel access to execute malicious Twig code, potentially leading to unauthorized actions or data exposure. Users should update to version 2.1.6 or higher to fix this vulnerability. Regularly monitoring form settings and restricting control panel access can also help mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for verbb/formie →
FAQ
verbb/formie is a package for Craft CMS that provides form building and management functionality.
Twig is a templating language used in Craft CMS to generate dynamic content.
An attacker with control panel access can inject malicious Twig code into form settings, which will be executed when a submission is created or the text is rendered.
The consequences can vary depending on the actions performed by the injected code, but they can include unauthorized access to the system or exposure of sensitive data.
The vulnerability is considered low-medium severity, as it requires control panel access to exploit.
References
Related vulnerabilities
Recent vulnerabilities recorded for verbb/formie.
