CVE-2024-45612: Contao Core Bundle Insert Tag Injection via Canonical URL
Summary
CVE-2024-45612: Contao affected by insert tag injection via canonical URL. Affects contao/core-bundle across 3 version ranges.
>= 4.13.0, < 4.13.49
>= 5.0.0, < 5.3.15
>= 5.4.0, < 5.4.3
Fixed in 4.13.49, 5.3.15 or 5.4.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Contao is an open-source content management system (CMS) designed for building and managing websites. It offers a user-friendly interface, flexible templating, and a robust set of features that cater to developers and non-technical users alike. However, like many web applications, it is susceptible to security vulnerabilities, including the recent insert tag injection issue affecting its core bundle.
Vulnerability Detail
The vulnerability arises from the ability to inject insert tags into canonical URLs within Contao. This flaw allows attackers to manipulate the rendering of pages by injecting malicious code, which can lead to unauthorized actions or information disclosure. The issue is classified under CWE-79, indicating that it involves improper handling of user input, which can compromise the integrity of the web application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.13.0, < 4.13.494.13.49composer require contao/core-bundle:4.13.49 -
>= 5.0.0, < 5.3.155.3.15composer require contao/core-bundle:5.3.15 -
>= 5.4.0, < 5.4.35.4.3composer require contao/core-bundle:5.4.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can disable canonical tags in the settings of the website root page to mitigate the risk of this vulnerability until an update can be applied.
Conclusion
The insert tag injection vulnerability in Contao's core bundle poses a moderate risk to users, allowing for potential manipulation of page rendering. It is crucial for users to update to the latest versions to safeguard their applications. Utilizing tools like Vulert can help in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for contao/core-bundle →
FAQ
Insert tag injection is a type of vulnerability where an attacker can inject malicious code into a web application, which is then executed when the page is rendered.
You can check your Contao version against the patched versions mentioned in the advisory. Additionally, you can use Vulert to monitor your application for vulnerabilities.
If exploited, this vulnerability could allow attackers to manipulate page content, potentially leading to data breaches or unauthorized actions on the website.
Yes, Vulert allows you to monitor for open-source vulnerabilities using just the composer.lock file, providing real-time alerts without requiring installation.
If an immediate update is not possible, it is recommended to disable canonical tags as a temporary workaround until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/core-bundle.
