The tags and multiselect fields allow to select tags from an autocompleted list. The tags field also allows to enter new tags or edit existing tags. Kirby already handled escaping of the autocompleted tags, but unfortunately the Panel used HTML rendering for new or edited tags as well as for custom tags from the content file.
This allowed attackers with Panel access to store malicious HTML code in a tag. The browser of the victim who visited the modified page in the Panel will then have rendered this malicious HTML code.
It also allowed self-inflicted XSS attacks in the tags field (meaning that malicious code is executed in the browser of the user who entered it). This could be used in social engineering attacks where a victim is convinced by an attacker to enter malicious code into a tags field.
Visitors without Panel access could only use this attack vector if your site allows changing the content of a tags or multiselect field from a frontend form (for example user self-registration or the creation of pages from a contact or other frontend form). If you validate or sanitize the provided form data, you are already protected against such attacks by external visitors.
You are also not affected by these vulnerabilities if your site doesn't have untrustworthy users with Panel access or a way to modify field values from the frontend or if you don't use the tags or multiselect fields.
Note: The fixes for these vulnerabilities have the side effect that every value in the tags and multiselect fields is displayed with double escaping (e.g. the & character is displayed as &) when dynamic options are enabled, while dynamic options themselves are displayed with triple escaping. We will fix the double/triple escaping issues with a refactoring of the options fields (tags, multiselect, checkboxes, radio, select and toggles) in Kirby 3.8.
The multiselect field allows to select tags from an autocompleted list. Unfortunately, the Panel in Kirby 3.5 used HTML rendering for the raw option value.
This allowed attackers with influence on the options source (e.g. content of sibling pages or an API endpoint) to inject HTML code. If a page in the Panel that uses the manipulated multiselect options was visited by a victim and the victim opened the autocomplete dropdown, the victim's browser will then have rendered this malicious HTML code.
You are not affected by this vulnerability if you don't use the multiselect field or only use it with options that cannot be manipulated by attackers.
3.5.8
Security release
This security release fixes two cross-site scripting (XSS) vulnerabilities from writer field and image block content printed in the site frontend.
Severity: medium (CVSS score 5.4)
Writer field
Impact
Kirby's writer field stores its formatted content as HTML code. Unlike with other field types, it is not possible to escape HTML special characters against cross-site scripting (XSS) attacks, otherwise the formatting would be lost.
Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the site frontend or Panel session of other users. If the user is logged in to the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim.
Because the writer field did not securely sanitize its contents on save, it was possible to inject malicious HTML code into the content file by sending it to Kirby's API directly without using the Panel. This malicious HTML code would then be displayed on the site frontend and executed in the browsers of site visitors and logged in users who are browsing the site.
This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users. They can escalate their privileges if they get access to the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible.
You are not affected if you don't use the writer field in any of your blueprints. The attack can only be performed by logged-in users and only surfaces in the site frontend (i.e. in your templates). The Panel itself is unaffected and will not execute JavaScript that was injected into writer field content.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/mauricerenck/kirby-podcaster/network/alerts).
dependabot[bot]
commented
1 year ago
Bumps getkirby/cms from 3.5.7.1 to 3.5.8.1.
Release notes
Sourced from getkirby/cms's releases.
... (truncated)
Commits
dbfa7e8Update version number and cert bundlece3fc2aUpdate dist filesb5b8863Fix XSS issue in the multiselect dropdown9519febFix XSS issue in the MultiselectInput9bc3945Fix XSS issue in the TagsInput25fc5c6Merge pull request from GHSA-x7j7-qp7j-hw3q11f5933Update version number; composer update4ae9d53Backport default image block snippet from 3.6.0f64364aBackport writer field fix from 3.6.0Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/mauricerenck/kirby-podcaster/network/alerts).