CVE-2024-37160: Formwork Package Suffers from Stored Cross-Site Scripting (XSS) Vulnerability
Summary
CVE-2024-37160: Cross-site scripting (XSS) vulnerability in Description metadata. Affects getformwork/formwork across 2 version ranges.
< 1.13.1
>= 2.0.0-beta.1, < 2.0.0-beta.2
Fixed in 1.13.1 or 2.0.0-beta.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Formwork is an open-source content management system designed for simplicity and flexibility. It allows users to create and manage websites with ease, utilizing a flat-file architecture. However, it has been identified that the package is vulnerable to a Stored Cross-Site Scripting (XSS) attack, which can be exploited by attackers to inject malicious scripts into the website's HTML, affecting all users who visit the site.
Vulnerability Detail
The vulnerability arises from inadequate input validation in the description metadata field, allowing an attacker with administrator privileges to inject arbitrary JavaScript code. This stored XSS vulnerability can lead to significant security risks, as the malicious script executes on every page of the website, potentially compromising user data and session information. The impact is widespread, affecting all visitors to the site, except for those accessing the administrative panel.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.13.11.13.1composer require getformwork/formwork:1.13.1 -
>= 2.0.0-beta.1, < 2.0.0-beta.22.0.0-beta.2composer require getformwork/formwork:2.0.0-beta.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators should avoid using the description field for any input that could contain HTML or JavaScript until the package is updated. Additionally, implementing Content Security Policy (CSP) headers can help mitigate the risk of XSS attacks.
Conclusion
The Stored XSS vulnerability in the Formwork package poses a significant risk to all users of the affected websites. It is crucial to update to the patched version to ensure the security of the site and its visitors. Administrators should take immediate action to mitigate risks and protect user data.
See every vulnerability recorded for getformwork/formwork →
FAQ
The vulnerability is a Stored Cross-Site Scripting (XSS) issue that allows attackers to inject malicious JavaScript into the website's HTML.
All users visiting the affected website are at risk, except for those accessing the administrative panel.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level.
If immediate updates are not possible, avoid using the vulnerable input fields and consider implementing Content Security Policy (CSP) headers as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for getformwork/formwork.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
