PT-2020-14199 · Wagtail+1 · Wagtail+1

Timothy Bautista · Published 2020-07-20 · Updated 2020-07-28 · CVE-2020-15118

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 2.7.4 and prior to 2.9.3

Description The issue arises when a form page type is made available to Wagtail editors through the wagtail.contrib.forms app, and the page template is built using Django's standard form rendering helpers such as form.as p. Any HTML tags used within a form field's help text will be rendered unescaped in the page, potentially allowing cross-site scripting attacks, including privilege escalation. This functionality should not have been made available to editor-level users. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Recommendations For versions prior to 2.7.4 and prior to 2.9.3, upgrade to Wagtail 2.7.4 or Wagtail 2.9.3, where help text will be escaped to prevent the inclusion of HTML tags. As a temporary workaround for site owners who are unable to upgrade to the new versions, secure form page templates by rendering forms field-by-field as per Django's documentation, but omitting the |safe filter when outputting the help text. Site owners who wish to re-enable the use of HTML within help text may set WAGTAILFORMS HELP TEXT ALLOW HTML = True in their configuration settings, accepting the risk of this being exploited by editors.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-15118

GHSA-2473-9HGQ-J7XW

PYSEC-2020-154

Affected Products

Django

Wagtail

References · 11

• https://github.com/wagtail/wagtail/commit/d9a41e7f24d08c024acc9a3094940199df94db34 · Patch
• https://osv.dev/vulnerability/GHSA-2473-9hgq-j7xw · Vendor Advisory
• https://docs.wagtail.io/en/stable/reference/contrib/forms/index.html#usage · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15118 · Security Note
• https://osv.dev/vulnerability/PYSEC-2020-154 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15118 · Vendor Advisory
• https://github.com/wagtail/wagtail · Note
• https://github.com/wagtail/wagtail/security/advisories/GHSA-2473-9hgq-j7xw · Note
• https://github.com/wagtail/wagtail/blob/master/docs/releases/2.9.3.rst · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2020-154.yaml · Note
• https://docs.djangoproject.com/en/3.0/ref/models/fields/#django.db.models.Field.help_text · Note