CVE-2024-39318: Ibexa Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget
Summary
CVE-2024-39318: Ibexa Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget. Affects ibexa/admin-ui versions >= 4.6.0-beta1, < 4.6.9. Fixed in 4.6.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ibexa Admin UI is a package that provides a user interface for managing content in the Ibexa DXP platform. It is primarily used by authenticated editors and administrators to upload files and perform various content management tasks. However, the file upload widget in Ibexa Admin UI is susceptible to a DOM-based Cross-site Scripting (XSS) vulnerability. This means that if an attacker can trick an editor or administrator into uploading a file with a specially crafted filename, they can execute arbitrary JavaScript code during the upload process. Although this vulnerability requires access permission to upload files, it can have significant consequences if exploited by an attacker.
Vulnerability Detail
The vulnerability in the file upload widget of Ibexa Admin UI allows an attacker to inject malicious JavaScript code by manipulating the filename of the uploaded file. This code is then executed during the upload process, potentially leading to unauthorized access, data theft, or other malicious activities. However, it is important to note that this vulnerability is not persistent, meaning that the payload is only executed during the upload and does not persist in the system. As a result, an attacker needs to trick an editor or administrator into uploading a file with a specially crafted filename to exploit this vulnerability. The fix for this vulnerability ensures that XSS payloads are properly escaped, preventing the execution of arbitrary JavaScript code.
How To Fix
Minimum fixed version
4.6.9
This is the first release that contains the fix.
composer require ibexa/admin-ui:4.6.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is recommended to update Ibexa Admin UI to the patched versions as soon as possible.
Conclusion
The file upload widget in Ibexa Admin UI is vulnerable to DOM-based Cross-site Scripting (XSS) attacks. Although the impact is limited to authenticated editors and administrators with access permission to upload files, it is crucial to update Ibexa Admin UI to the patched versions (4.6.9 or later) to mitigate the risk of exploitation. The fix ensures that XSS payloads in filenames are properly escaped, preventing the execution of arbitrary JavaScript code.
See every vulnerability recorded for ibexa/admin-ui →
FAQ
Ibexa Admin UI is a package that provides a user interface for managing content in the Ibexa DXP platform. It is primarily used by authenticated editors and administrators to perform various content management tasks.
This vulnerability affects users of Ibexa Admin UI who have access permission to upload files. In most cases, this includes authenticated editors and administrators.
No, this vulnerability is not persistent. The payload is only executed during the upload process and does not persist in the system.
An attacker can exploit this vulnerability by tricking an editor or administrator into uploading a file with a specially crafted filename that contains malicious JavaScript code. This code is then executed during the upload process.
If exploited, this vulnerability can lead to unauthorized access, data theft, or other malicious activities. However, since it requires access permission to upload files, the impact is limited to authenticated editors and administrators.
References
Related vulnerabilities
Recent vulnerabilities recorded for ibexa/admin-ui.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
