Cross-site scripting vulnerability in Markdown fields in Formwork
Summary
CVE-2024-35621: formwork Cross-site scripting vulnerability in Markdown fields. Affects getformwork/formwork versions < 1.13.0. Fixed in 1.13.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Formwork is a package available on Packagist that provides an administration panel for managing website content. It allows users with page editing permissions to create and edit pages using Markdown fields. Markdown is a lightweight markup language that converts plain text into HTML. However, a vulnerability has been discovered in Formwork that allows users to insert malicious script tags in Markdown fields, which are then displayed on publicly accessible site pages. This vulnerability can lead to potential cross-site scripting (XSS) injections.
Vulnerability Detail
The vulnerability in Formwork arises from the lack of proper sanitization of user input in Markdown fields. This allows users with access to the administration panel and page editing permissions to insert <script> tags, which can execute arbitrary JavaScript code on the site pages. This can lead to various security risks, such as stealing user session cookies, defacing the website, or redirecting users to malicious websites. The vulnerability has a CVSS score of 4.8, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.13.0
This is the first release that contains the fix.
composer require getformwork/formwork:1.13.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Cross-site scripting vulnerability in Markdown fields in Formwork allows users with access to the administration panel and page editing permissions to insert malicious script tags, leading to potential XSS injections. To fix this vulnerability, it is recommended to update the Formwork package to version 1.13.0 or later and configure the content.safe_mode option appropriately. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for getformwork/formwork →
FAQ
The vulnerability allows users with access to the administration panel and page editing permissions to insert malicious script tags in Markdown fields. These tags are then displayed on publicly accessible site pages, potentially leading to cross-site scripting (XSS) injections. This can result in various security risks, such as stealing user session cookies, defacing the website, or redirecting users to malicious websites.
To fix this vulnerability, you should update the Formwork package to version 1.13.0 or later. This version includes a patch that introduces a new system configuration option called content.safe_mode. By default, this option escapes HTML tags and dangerous links in Markdown fields to prevent XSS injections. Ensure that only a controlled group of editors have access to the administration panel and cannot enable the content.safe_mode option themselves to mitigate the risk of introducing vulnerabilities.
There is no specific workaround for this vulnerability. The recommended solution is to update the Formwork package to version 1.13.0 or later and configure the content.safe_mode option appropriately.
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level.
You can find more information about this vulnerability in the CVE entry: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35621
References
Related vulnerabilities
Recent vulnerabilities recorded for getformwork/formwork.
