PT-2021-18230 · Kirby · Kirby
Sreenathr10
·
Published
2021-04-27
·
Updated
2021-05-07
·
CVE-2021-29460
CVSS v3.1
7.6
High
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
Kirby versions prior to 3.5.4
Description:
The issue allows an editor with write access to the Kirby Panel to upload an SVG or XML file containing harmful content like
<script> tags. If a victim opens the link to the file in a browser where they are logged in to Kirby, the script can run and trigger requests to Kirby's API with the victim's permissions. This can lead to privilege escalation if an attacker gains access to an admin user's Panel session. Visitors without Panel access can exploit this if the site allows SVG or XML file uploads in frontend forms without validation or sanitization.Recommendations:
To resolve the issue, update to Kirby 3.5.4 or a later version.
For frontend upload forms, ensure they are patched separately based on how they store uploaded files.
If using
File::create(), updating to Kirby 3.5.4+ provides protection.
As a temporary workaround, consider disabling the upload of SVG and XML files in file blueprints until a patch is applied.
After updating, run the provided validator script to check for existing harmful files and review any listed errors for manual fixing.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Kirby