CVE-2024-41964: Kirby CMS Insufficient Permission Checks in Language Settings
Summary
CVE-2024-41964: Kirby has insufficient permission checks in the language settings. Affects getkirby/cms across 6 version ranges.
< 3.6.6.6
>= 3.7.0, < 3.7.5.5
>= 3.8.0, < 3.8.4.4
>= 3.9.0, < 3.9.8.2
>= 3.10.0, < 3.10.1.1
>= 4.0.0, < 4.3.1
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kirby CMS is an open-source content management system that allows users to create and manage websites. It provides features for multi-language content management, including the ability to create, update, and delete languages. However, prior to version 3.6.6.6, 3.7.5.5, 3.8.4.4, 3.9.8.2, 3.10.1.1, and 4.3.1, Kirby had insufficient permission checks in the language settings, which could be exploited by authenticated Panel users to manipulate language definitions.
Vulnerability Detail
The vulnerability in Kirby CMS allowed attackers with Panel access to modify language definitions. This could lead to various consequences, such as enabling multi-language mode, deleting translated content, changing metadata and language variables, and altering the default language. These actions could result in loss of site availability, integrity issues, and potential security risks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.6.6.63.6.6.6composer require getkirby/cms:3.6.6.6 -
>= 3.7.0, < 3.7.5.53.7.5.5composer require getkirby/cms:3.7.5.5 -
>= 3.8.0, < 3.8.4.43.8.4.4composer require getkirby/cms:3.8.4.4 -
>= 3.9.0, < 3.9.8.23.9.8.2composer require getkirby/cms:3.9.8.2 -
>= 3.10.0, < 3.10.1.13.10.1.1composer require getkirby/cms:3.10.1.1 -
>= 4.0.0, < 4.3.14.3.1composer require getkirby/cms:4.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a temporary workaround is to disable the 'languages' and 'api' options in the Kirby configuration. Additionally, ensure that no code is calling methods that cause write access to languages. By disabling these options and avoiding language-related write operations, the vulnerability can be mitigated.
Conclusion
The vulnerability in Kirby CMS's language settings could be exploited by authenticated Panel users to manipulate language definitions, leading to various consequences and potential security risks. It is crucial to update to the patched versions or apply the recommended workarounds to mitigate this vulnerability.
See every vulnerability recorded for getkirby/cms →
FAQ
The vulnerability allows authenticated Panel users to manipulate language definitions, potentially leading to loss of site availability, content loss, integrity issues, and security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
No, only versions prior to 3.6.6.6, 3.7.5.5, 3.8.4.4, 3.9.8.2, 3.10.1.1, and 4.3.1 are affected. It is recommended to update to one of these versions or a later release to fix the vulnerability.
An attacker with Panel access can create, delete, and update language definitions. This can enable multi-language mode, delete translated content, change metadata and language variables, and alter the default language.
Yes, you can temporarily disable the 'languages' and 'api' options in the Kirby configuration. Additionally, ensure that no code is calling methods that cause write access to languages.
References
Related vulnerabilities
Recent vulnerabilities recorded for getkirby/cms.
