CVE-2024-43369: Persistent Cross-site Scripting in Ibexa RichText Field Type
Summary
CVE-2024-43369: Persistent Cross-site Scripting in Ibexa RichText Field Type. Affects ibexa/fieldtype-richtext versions >= 4.6.0, < 4.6.10. Fixed in 4.6.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Ibexa RichText Field Type is a package available on Packagist that provides a field type for rich text content in the Ibexa CMS. It allows users to create and edit content with formatting options such as bold, italic, links, and more. This package is commonly used in web applications built on the Ibexa CMS platform.
Vulnerability Detail
The vulnerability identified as CVE-2024-43369 is a persistent cross-site scripting (XSS) issue in the Ibexa RichText Field Type. The validator for the RichText field type blocks certain protocols like javascript: and vbscript: to prevent XSS attacks. However, this check can be circumvented by using uppercase characters or other protocols. An attacker with content editing permissions for RichText content, typically an Editor role or higher, can exploit this vulnerability. The impact of this vulnerability is the potential execution of malicious scripts in the context of the affected user's session, leading to various security risks such as session hijacking, defacement, or data theft.
How To Fix
Minimum fixed version
4.6.10
This is the first release that contains the fix.
composer require ibexa/fieldtype-richtext:4.6.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is recommended to apply the fix by updating to the latest patched version of the Ibexa RichText Field Type package.
Conclusion
The Ibexa RichText Field Type package is vulnerable to a persistent cross-site scripting (XSS) issue that can be exploited by attackers with content editing permissions. The package has released a fix that implements an allowlist approach to prevent XSS attacks. Users are advised to update to the latest patched version of the package to mitigate this vulnerability.
See every vulnerability recorded for ibexa/fieldtype-richtext →
FAQ
The vulnerability allows an attacker with content editing permissions to execute malicious scripts in the context of the affected user's session, potentially leading to session hijacking, defacement, or data theft.
Users of web applications built on the Ibexa CMS platform that utilize the Ibexa RichText Field Type package are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this advisory.
Users should update to the latest patched version of the Ibexa RichText Field Type package (version 4.6.10 or later) to mitigate this vulnerability.
There are no known workarounds for this vulnerability. It is recommended to apply the fix by updating to the latest patched version of the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for ibexa/fieldtype-richtext.
