PT-2021-19846 · Flarum · Flarum

Luceos · Published 2021-06-07 · Updated 2021-06-17 · CVE-2021-32671

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flarum versions 1.0.0 through 1.0.1

Description The issue arises from Flarum's translation system, which allowed string inputs to be converted into HTML DOM nodes when rendered. This enabled users to input malicious HTML markup within certain fields, executing it on client browsers. For example, entering <script>alert('test')</script> in the forum search box resulted in an alert box appearing. This attack could be modified to perform AJAX requests, potentially deleting discussions, modifying user settings or profiles, or even modifying Admin panel settings if targeted at a privileged user.

Recommendations To resolve the issue, upgrade to Flarum/core version 1.0.2 as soon as possible. This can be done using the command composer update --prefer-dist --no-dev -a -W, and then confirm the latest version is installed with composer show flarum/core.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-32671

GHSA-5QJQ-69W6-FG57

Affected Products

Flarum

References · 6

• https://github.com/flarum/core/commit/440bed81b8019dff00642c8f493b4909d505a28a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-32671 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32671 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5qjq-69w6-fg57 · Vendor Advisory
• https://github.com/flarum/core/security/advisories/GHSA-5qjq-69w6-fg57 · Note
• https://packagist.org/packages/flarum/core · Note