PT-2023-26472 · Kirby · Kirby
5Hank4R
+1
·
Publicado
2023-07-27
·
Atualizado
2026-04-17
·
CVE-2023-38491
CVSS v3.1
5.7
Média
| Vetor | AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Kirby versions prior to 3.5.8.3
Kirby versions prior to 3.6.6.3
Kirby versions prior to 3.7.5.2
Kirby versions prior to 3.8.4.1
Kirby versions prior to 3.9.6
Description
The issue affects Kirby sites that allow file uploads from untrusted users or visitors, or those that do not limit file extensions to a safe list. An editor with write access to the Kirby Panel can upload a file with an unknown extension, such as
.xyz, containing HTML code with harmful content like <script> tags. If a victim opens the link to this file in a browser where they are logged in to Kirby, the browser may run the script, potentially triggering requests to Kirby's API with the victim's permissions. The problem is caused by the KirbyHttpResponse::file() method lacking an explicit fallback for unknown MIME types.Recommendations
Update to Kirby version 3.5.8.3 or later to fix the vulnerability.
Update to Kirby version 3.6.6.3 or later to fix the vulnerability.
Update to Kirby version 3.7.5.2 or later to fix the vulnerability.
Update to Kirby version 3.8.4.1 or later to fix the vulnerability.
Update to Kirby version 3.9.6 or later to fix the vulnerability.
Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Kirby