Cross-Site Scripting (XSS) Vulnerability in Formwork Package
Summary
GHSA-vf6x-59hh-332f: Formwork has a cross-site scripting (XSS) vulnerability in Site title. Affects getformwork/formwork versions >= 2.0.0-beta.3, < 2.0.0-beta.4. Fixed in 2.0.0-beta.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Formwork is an open-source content management system that allows users to create and manage websites easily. It is designed for simplicity and flexibility, providing features such as customizable themes, user management, and a straightforward interface. However, it has a vulnerability in the site title field that allows for the embedding of JavaScript, posing a risk to system security.
Vulnerability Detail
The vulnerability arises from the site title field located at /panel/options/site, which permits the embedding of JavaScript tags. This can lead to cross-site scripting (XSS) attacks, where an attacker could execute malicious scripts in the context of other users' sessions. The potential ramifications include unauthorized access to user data, system disruption, and a significant impact on system availability. Although the attacker would need admin privileges to exploit this vulnerability, the consequences could still be severe, especially in systems with a large user base.
How To Fix
Minimum fixed version
2.0.0-beta.4
This is the first release that contains the fix.
composer require getformwork/formwork:2.0.0-beta.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using special characters or JavaScript in the site title field until the package is updated. Regularly monitor the site for any unusual behavior and restrict admin access to trusted users only.
Conclusion
In summary, the cross-site scripting vulnerability in the Formwork package poses a significant risk to users and system integrity. It is crucial to update to the patched version to mitigate these risks and ensure the security of your application.
See every vulnerability recorded for getformwork/formwork →
FAQ
The vulnerability is a cross-site scripting (XSS) flaw that allows the embedding of JavaScript in the site title field.
If exploited, this vulnerability can lead to unauthorized access to user data, system disruption, and a significant impact on system availability.
Yes, a patch is available in Formwork version 2.x, which escapes the site title from the panel header navigation.
As a temporary measure, avoid using special characters in the site title and limit admin access to trusted users.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for getformwork/formwork.
