PT-2023-25717 · Statamic · Statamic

Robyfirnandoyusuf · Publicado 2023-07-05 · Atualizado 2023-07-12 · CVE-2023-36828

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 4.10.0

Description The issue concerns the SVG tag not sanitizing malicious SVG, allowing an attacker to perform cross-site scripting attacks using SVG, even when using the sanitize function. This can be exploited by uploading a manipulated SVG file, potentially triggering an XSS vulnerability. The estimated number of potentially affected devices is not specified.

Technical details about exploitation include:

• API Endpoints: Not specified
• Vulnerable Parameters or Variables: sanitize function, File::get()
• Function Names: sanitize function

Recommendations For versions prior to 4.10.0, update to version 4.10.0 to resolve the issue. As a temporary workaround, consider sanitizing the SVG when outputting it, utilizing a reliable package such as https://github.com/darylldoyle/svg-sanitizer to ensure comprehensive SVG sanitization capabilities. Restrict access to uploading SVG files to minimize the risk of exploitation until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-36828

GHSA-6R5G-CQ4Q-327G

Produtos afetados

Statamic

Referências · 12

• 🔥 https://github.com/statamic/cms/security/advisories/GHSA-6r5g-cq4q-327g · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36828.json · Exploit
• https://github.com/statamic/cms · Nota
• https://github.com/statamic/cms/blob/f806b6b007ddcf066082eef175653c5beaa96d60/src/Tags/Svg.php#L36-L40 · Nota
• https://github.com/statamic/cms/blob/f806b6b007ddcf066082eef175653c5beaa96d60/src/Http/Controllers/CP/Fieldtypes/FilesFieldtypeController.php#L15 · Nota
• https://github.com/statamic/cms/commit/c714893ad92de6e5ede17b501003441af505b30d · Correção
• https://github.com/statamic/cms/pull/8408 · Correção
• https://github.com/statamic/cms/releases/tag/v4.10.0 · Nota
• https://t.me/cvenotify/53696 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-6r5g-cq4q-327g · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-36828 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-36828 · Aviso do Fabricante