CVE-2024-47617: Sulu CMS MediaBundle Reflected XSS Vulnerability
Summary
CVE-2024-47617: Injection of arbitrary HTML/JavaScript code through the media download URL. Affects sulu/sulu across 2 version ranges.
>= 2.0.0, < 2.5.21
>= 2.6.0, < 2.6.5
Fixed in 2.5.21 or 2.6.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sulu CMS is an open-source content management system designed for managing websites and applications. It offers a flexible and user-friendly interface, allowing developers to create and manage content efficiently. The SuluMediaBundle component is responsible for handling media files within the CMS. However, it is vulnerable to a reflected cross-site scripting (XSS) issue, which can be exploited through the media download URL, posing a risk to users and their data.
Vulnerability Detail
The vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in the SuluMediaBundle component. This reflected XSS issue can lead to various malicious activities, including stealing sensitive information, manipulating website content, or executing actions on behalf of the victim. The vulnerability arises from insufficient input validation and output encoding in the MediaStreamController's downloadAction method.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.5.212.5.21composer require sulu/sulu:2.5.21 -
>= 2.6.0, < 2.6.52.6.5composer require sulu/sulu:2.6.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Until an official patch is released, users can implement additional input validation and output encoding for the 'slug' parameter in the MediaStreamController's downloadAction method. Additionally, configuring a Web Application Firewall (WAF) to filter potentially malicious input can serve as a temporary mitigation. Here is an example of how to validate the 'slug' parameter:
if (preg_match('/^[a-zA-Z0-9-_]+$/', $slug)) {
// Proceed with the download action
} else {
// Handle invalid slug input
}
Conclusion
The CVE-2024-47617 vulnerability in the Sulu CMS MediaBundle poses a significant risk due to its potential for reflected XSS attacks. Users are encouraged to implement workarounds and stay updated on patches to protect their applications from exploitation.
See every vulnerability recorded for sulu/sulu →
FAQ
CVE-2024-47617 is a vulnerability in the Sulu CMS MediaBundle that allows for the injection of arbitrary HTML/JavaScript code through the media download URL, leading to reflected XSS attacks.
Exploitation of this vulnerability can allow attackers to steal sensitive information, manipulate website content, or perform actions on behalf of users, compromising the security and integrity of your website.
The affected versions of Sulu CMS are 2.6.4 and 2.5.20. Users running these versions should take immediate action to mitigate the risk.
As of now, there is no official patch available. Users are advised to monitor the Sulu repository for updates and apply them as soon as they are released.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for sulu/sulu.
