PT-2022-23133 · Kirby · Kirby

Lukasbestle · Published 2022-08-29 · Updated 2022-09-07 · CVE-2022-36037

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kirby versions 3.5 through 3.5.8.0

Description Cross-site scripting (XSS) allows execution of JavaScript code inside the Panel session of the same or other users. A harmful script can trigger requests to Kirby's API with the permissions of the victim. If attackers gain access to a group of authenticated Panel users, they can escalate their privileges via the Panel session of an admin user. The multiselect field allows selection of tags from an autocompleted list, and in Kirby 3.5, it used HTML rendering for the raw option value, allowing attackers to store HTML code. The browser of the victim who visited a page with manipulated multiselect options in the Panel will render this malicious HTML code when the victim opens the autocomplete dropdown.

Recommendations For Kirby versions 3.5 through 3.5.8.0, update to Kirby 3.5.8.1 or a later version to fix the vulnerability. As a temporary workaround, consider disabling the multiselect field by uncommenting it from all blueprints.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-36037

GHSA-3F89-869F-5W76

Affected Products

Kirby

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36037.json · Exploit
• https://github.com/getkirby/kirby/commit/b5b8863885e17556abc070dde1e20aec15fbfdf5 · Patch
• https://github.com/getkirby/kirby/security/advisories/GHSA-3f89-869f-5w76 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-36037 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36037 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3f89-869f-5w76 · Vendor Advisory
• https://github.com/getkirby/kirby · Note
• https://github.com/getkirby/kirby/releases/tag/3.5.8.1 · Note
• https://t.me/cibsecurity/49005 · Telegram Post