Bastianallgeier

Name of the Vulnerable Software and Affected Versions: Kirby versions prior to 3.9.8.3 Kirby versions prior to 3.10.1.2 Kirby versions prior to 4.7.1 Description: A vulnerability in Kirby affects setups that use PHP's built-in server, commonly used during local development. This issue allows attackers to navigate all files on the server accessible to the PHP process, including files outside of the Kirby installation, due to a missing path traversal check. The vulnerable implementation delegates existing files to PHP, including files outside of the document root, leading to different responses that allow attackers to determine whether the requested file exists. However, the contents of the files were not exposed as PHP treats requests to files outside of the document root as invalid. Recommendations: For versions prior to 3.9.8.3, update to Kirby 3.9.8.3 or later. For versions prior to 3.10.1.2, update to Kirby 3.10.1.2 or later. For versions prior to 4.7.1, update to Kirby 4.7.1 or later.

Name of the Vulnerable Software and Affected Versions: Kirby versions prior to 3.9.8.3 Kirby versions prior to 3.10.1.2 Kirby versions prior to 4.7.1 Description: A vulnerability in Kirby affects sites that use the `collection()` helper or `$kirby->collection()` method with a dynamic collection name, allowing attackers to navigate and access all files on the server that were accessible to the PHP process. This includes files outside of the collections root or even outside of the Kirby installation, with PHP code within such files being executed. The attack requires an attack vector in the site code caused by dynamic collection names and knowledge of the site structure and the server's file system. However, it is possible to find vulnerable setups through automated methods such as fuzzing. This could cause damage to the confidentiality and integrity of the server. Recommendations: For versions prior to 3.9.8.3, update to Kirby 3.9.8.3 or later. For versions prior to 3.10.1.2, update to Kirby 3.10.1.2 or later. For versions prior to 4.7.1, update to Kirby 4.7.1 or later. As a temporary workaround, consider avoiding the use of dynamic collection names in the `collection()` helper or `$kirby->collection()` method until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** bastianallgeier Kirby Webmentions Plugin (affected versions not specified) **Description** A vulnerability was found in the bastianallgeier Kirby Webmentions Plugin, allowing for injection attacks. The manipulation can be launched remotely, but the complexity of the attack is rather high, and exploitation is known to be difficult. **Recommendations** Apply a patch to fix this issue. The patch is identified as 55bedea78ae9af916a9a41497bd9996417851502.

**Name of the Vulnerable Software and Affected Versions** Kirby versions prior to 3.5.8.2 Kirby versions prior to 3.6.6.2 Kirby versions prior to 3.7.5.1 Kirby versions prior to 3.8.1 **Description** The issue affects Kirby sites with user accounts, unless the API and Panel are disabled in the config. It allows attackers to confirm which users are registered in a Kirby installation through user enumeration, which can be used for social engineering attacks or to determine the organizational structure of a company. The vulnerability can only be exploited for targeted attacks because it does not scale to brute force due to the delay during the first 10 requests per user and the faint difference between responses for valid and invalid users. **Recommendations** For versions prior to 3.5.8.2, update to Kirby 3.5.8.2 or a later version. For versions prior to 3.6.6.2, update to Kirby 3.6.6.2 or a later version. For versions prior to 3.7.5.1, update to Kirby 3.7.5.1 or a later version. For versions prior to 3.8.1, update to Kirby 3.8.1 or a later version. As a temporary workaround, consider disabling the API and Panel in the config to prevent exploitation.