DOM-based Cross-site Scripting Vulnerability in eZ Platform Admin UI
Summary
GHSA-gc5h-6jx9-q2qh: eZ Platform Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget. Affects ezsystems/ezplatform-admin-ui versions >= 3.3.0, < 3.3.39. Fixed in 3.3.39. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
eZ Platform Admin UI is a package that provides a user interface for managing content in the eZ Platform CMS. It allows authenticated editors and administrators to upload files. However, the file upload widget in the package is vulnerable to DOM-based Cross-site Scripting (XSS) attacks when malicious payloads are included in filenames. This vulnerability requires the attacker to trick an editor or administrator into uploading a file with a specially crafted name. The impact of this vulnerability is moderate, as it is not persistent and the payload is only executed during the upload process.
Vulnerability Detail
The vulnerability in the eZ Platform Admin UI package allows for the execution of XSS payloads through filenames during the file upload process. This can be exploited by an attacker who can trick an editor or administrator into uploading a file with a malicious name. The vulnerability is not persistent, meaning the payload is only executed during the upload. However, it requires access permission to upload files, limiting its impact to authenticated users with the necessary privileges. The fix for this vulnerability ensures that XSS is properly escaped, preventing the execution of malicious scripts.
How To Fix
Minimum fixed version
3.3.39
This is the first release that contains the fix.
composer require ezsystems/ezplatform-admin-ui:3.3.39Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is recommended to update the package to the latest version as soon as possible.
Conclusion
The eZ Platform Admin UI package is vulnerable to DOM-based Cross-site Scripting (XSS) attacks in the file upload widget. This vulnerability can be exploited by tricking an editor or administrator into uploading a file with a malicious name. It is recommended to update the package to version 3.3.39 or later to fix this vulnerability and prevent the execution of XSS payloads.
See every vulnerability recorded for ezsystems/ezplatform-admin-ui →
FAQ
The impact of this vulnerability is moderate, as it requires access permission to upload files and the payload is only executed during the upload process. However, an attacker can exploit this vulnerability to execute XSS payloads by tricking an editor or administrator into uploading a file with a specially crafted name.
This vulnerability affects users of the eZ Platform Admin UI package, specifically authenticated editors and administrators who have permission to upload files.
No, this vulnerability is not persistent. The XSS payload is only executed during the file upload process.
No, there are no known workarounds for this vulnerability. It is recommended to update the package to the latest version.
To protect your application from this vulnerability, ensure that you have updated the eZ Platform Admin UI package to version 3.3.39 or later. This update includes the necessary patch to escape XSS payloads in filenames during the file upload process.
References
Related vulnerabilities
Recent vulnerabilities recorded for ezsystems/ezplatform-admin-ui.
