PT-2021-17662 · Mautic · Mautic

Alanhartless + 1 · Published 2021-03-23 · Updated 2022-07-29 · CVE-2021-27908

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions: Mautic versions prior to 3.3.2

Description: The issue allows an authorized admin user to expose secret parameters, such as database credentials, publicly by leveraging Symfony parameter syntax in free text fields within Mautic's configuration. This can be done in publicly facing parts of the application. For example, an admin can enter a script in the Analytics script field that logs the database password to the console, which can then be accessed by visiting a landing page and opening the JavaScript developer console.

Recommendations: Upgrade to version 3.3.2 to resolve the issue. As a temporary workaround, consider restricting access to the configuration fields that use Symfony parameter syntax to minimize the risk of exploitation. Avoid using sensitive parameters, such as mautic.db password, in free text fields until the issue is resolved.

Exploit

Fix

Special Elements Injection

Information Disclosure

Incorrect Permission

Weakness Enumeration

CWE-74

CWE-200

CWE-732

Related Identifiers

CVE-2021-27908

GHSA-4HJQ-422Q-4VPX

Affected Products

Mautic

References · 7

• 🔥 https://github.com/mautic/mautic/security/advisories/GHSA-4hjq-422q-4vpx · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/mautic/core/CVE-2021-27908.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-27908 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27908 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4hjq-422q-4vpx · Vendor Advisory
• https://github.com/mautic/mautic · Note
• https://t.me/cibsecurity/25346 · Telegram Post