Path Traversal and Reflected XSS Vulnerability in EasyAdminBundle
Summary
GHSA-2wwr-9x6f-88gp: EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components. Affects easycorp/easyadmin-bundle across 2 version ranges.
>= 4.0.0, < 4.29.10
>= 5.0.0, < 5.0.10
Fixed in 4.29.10 or 5.0.10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
EasyAdminBundle is a popular Symfony bundle that provides a user-friendly interface for managing application data. It allows developers to create admin panels quickly and efficiently, utilizing Twig templates for rendering. The bundle includes various components, including the Flag and Icon Twig components, which are designed to display country flags and icons, respectively. However, these components have been found to be vulnerable to path traversal and reflected XSS attacks due to improper handling of user input.
Vulnerability Detail
The vulnerability arises from the Flag and Icon components loading SVG files from disk using a path constructed directly from user-controlled properties. This lack of validation allows for path traversal, enabling attackers to access arbitrary SVG files on the server. Additionally, the Flag component can lead to reflected XSS if the requested flag file does not exist, as it interpolates the raw countryCode value into a hard-coded SVG string, which is then rendered with the Twig |raw filter. This can allow an attacker to inject malicious HTML or JavaScript that executes in the admin context.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0, < 4.29.104.29.10composer require easycorp/easyadmin-bundle:4.29.10 -
>= 5.0.0, < 5.0.105.0.10composer require easycorp/easyadmin-bundle:5.0.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that the properties 'countryCode' and 'name' passed to the Flag and Icon components are strictly validated and sanitized to prevent user-controlled data from being used directly. Avoid using dynamic values for these properties until the package is updated.
Conclusion
The EasyAdminBundle has a significant vulnerability related to path traversal and reflected XSS in its Flag and Icon components. It is crucial for developers using this package to update to the latest patched versions to mitigate these risks. Additionally, implementing proper input validation can help prevent exploitation until an update can be applied.
See every vulnerability recorded for easycorp/easyadmin-bundle →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup at Vulert Scanner.
The potential impacts include unauthorized access to sensitive SVG files on the server and the ability to execute arbitrary JavaScript in the admin context, which can lead to further exploitation.
No, the first-party usage of EasyAdminBundle is not affected as it only passes validated data to the components. The vulnerability is reachable only in third-party templates.
If you cannot update the package immediately, implement strict validation and sanitization of user inputs for the affected components as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for easycorp/easyadmin-bundle.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.