Dapatrese

**Name of the Vulnerable Software and Affected Versions** Kirby versões anteriores a 4.9.0 Kirby versões anteriores a 5.4.0 **Description** O método `Xml::value()` no Kirby contém uma falha na maneira como processa blocos `<![CDATA[ ]]>`. Embora o método seja projetado para permitir que `CDATA` válido passe sem ser escapado por uma segunda vez, era possível fornecer entradas que continham um bloco `CDATA` válido juntamente com outros dados estruturados. Isso permitia que os dados estruturados ignorassem a proteção de valor, potencialmente levando a uma injeção de XML. A injeção de XML é um ataque onde caracteres especiais são injetados em dados de entrada para gerar uma saída XML com significado malicioso, o que pode manipular o comportamento de sistemas que analisam o esquema XML resultante. Este problema afeta o método `Xml::value()`, bem como `Xml::tag()`, `Xml::create()` e o manipulador de dados `Xml` (ex: `Data::encode($string, 'xml')`). Esses componentes não são usados no núcleo do Kirby, mas podem ser utilizados em códigos de sites ou plugins para criar strings XML a partir de dados de entrada. **Recommendations** Atualize para a versão 4.9.0 ou posterior. Atualize para a versão 5.4.0 ou posterior. Como medida paliativa temporária, restrinja ou evite o uso das funções `Xml::value()`, `Xml::tag()`, `Xml::create()` e do manipulador de dados `Xml` em códigos de sites ou plugins se eles processarem entradas controladas por atacantes.

**Name of the Vulnerable Software and Affected Versions** Kirby versions prior to 3.5.8.3 Kirby versions prior to 3.6.6.3 Kirby versions prior to 3.7.5.2 Kirby versions prior to 3.8.4.1 Kirby versions prior to 3.9.6 **Description** A field injection vulnerability in Kirby's content storage implementation allows attackers with content write access to overwrite content fields that the site developer didn't intend to be modified. This can be used to alter site content, break site behavior, or inject malicious data or code. The exact security risk depends on the field type and usage. Kirby stores content in text files using the KirbyData format, where each field is separated by newlines and a line with four dashes (`----`). The vulnerability can be exploited by including a Unicode BOM sequence in a field separator, which can be abused to inject other field data into content files. **Recommendations** Update to Kirby version 3.5.8.3 or later to fix the vulnerability. Update to Kirby version 3.6.6.3 or later to fix the vulnerability. Update to Kirby version 3.7.5.2 or later to fix the vulnerability. Update to Kirby version 3.8.4.1 or later to fix the vulnerability. Update to Kirby version 3.9.6 or later to fix the vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kirby versions prior to 3.5.8.3 Kirby versions prior to 3.6.6.3 Kirby versions prior to 3.7.5.2 Kirby versions prior to 3.8.4.1 Kirby versions prior to 3.9.6 **Description** The issue affects Kirby sites that use the `Xml` data handler or the `Xml::parse()` method in site or plugin code. XML External Entities (XXE) is a feature in the XML markup language that allows including data from external files in an XML structure. If the name of the external file can be controlled by an attacker, this becomes a vulnerability that can be abused for various system impacts like the disclosure of internal or confidential data stored on the server or to perform network requests on behalf of the server. The `Xml::parse()` method used PHP's `LIBXML NOENT` constant, which enabled the processing of XML external entities during the parsing operation. This method is used in the `Xml` data handler. Both the vulnerable method and the data handler are not used in the Kirby core but may be used in site or plugin code to parse RSS feeds or other XML files. If those files are of an external origin, attackers may be able to include an external entity in the XML file that will then be processed in the parsing process. **Recommendations** Update to Kirby version 3.5.8.3 or later to fix the vulnerability. Update to Kirby version 3.6.6.3 or later to fix the vulnerability. Update to Kirby version 3.7.5.2 or later to fix the vulnerability. Update to Kirby version 3.8.4.1 or later to fix the vulnerability. Update to Kirby version 3.9.6 or later to fix the vulnerability. As a temporary workaround, consider disabling the `Xml::parse()` method or restricting the use of the `Xml` data handler until a patch is available. Avoid using the `Xml` data handler or the `Xml::parse()` method with XML input controlled by an attacker.