Local File Inclusion Vulnerability in Winter CMS's Asset Management System
Summary
GHSA-2223-f22x-24cq: Winter: Local File Inclusion through =include directives in JavaScript asset compilation. Affects winter/wn-system-module versions < 1.2.13. Fixed in 1.2.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Winter CMS is an open-source content management system built on the Laravel framework, designed for developers to create and manage websites efficiently. It provides a range of features, including asset management for images, JavaScript files, and CSS files. However, a vulnerability has been identified in the asset management system that allows authenticated users to exploit file inclusion directives, potentially leading to unauthorized access to sensitive files on the server.
Vulnerability Detail
The vulnerability arises from the improper handling of '=include' and '=require' directives in JavaScript assets. Authenticated users with the 'cms.manage_assets' permission can craft directives that reference files outside the intended directory structure. This allows them to disclose sensitive files, such as the application’s .env file, which contains critical configuration details like database credentials. The vulnerability is exacerbated by the fact that the combined output of these assets is served without authentication checks, making it accessible to unauthenticated visitors.
How To Fix
Minimum fixed version
1.2.13
This is the first release that contains the fix.
composer require winter/wn-system-module:1.2.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot upgrade immediately, you can manually apply the following changes to mitigate the risk: 1. Remove the 'cms.manage_assets' permission from any role that is not held by trusted administrators or developers. 2. Audit existing theme JavaScript assets for any '=include' or '=require' directives that resolve outside the theme's asset directory.
Conclusion
The Local File Inclusion vulnerability in Winter CMS's asset management system poses a significant risk to applications that allow certain user permissions. It is crucial to update to the latest version or apply the recommended workarounds to mitigate potential exploitation. Regular audits and monitoring using tools like Vulert can help maintain the security of your application.
See every vulnerability recorded for winter/wn-system-module →
FAQ
The vulnerability allows authenticated users to include arbitrary files on the server by exploiting the asset management system's handling of JavaScript directives.
Any instance of Winter CMS that allows authenticated users with the 'cms.manage_assets' permission is potentially affected.
An attacker could disclose sensitive information, such as database credentials and application configuration details, by accessing files like the .env file.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 4.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for winter/wn-system-module.
