PT-2023-25717 · Statamic · Statamic

Robyfirnandoyusuf · Published 2023-07-05 · Updated 2023-07-12 · CVE-2023-36828

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 4.10.0

Description The issue concerns the SVG tag not sanitizing malicious SVG, allowing an attacker to perform cross-site scripting attacks using SVG, even when using the sanitize function. This can be exploited by uploading a manipulated SVG file, potentially triggering an XSS vulnerability. The estimated number of potentially affected devices is not specified.

Technical details about exploitation include:

• API Endpoints: Not specified
• Vulnerable Parameters or Variables: sanitize function, File::get()
• Function Names: sanitize function

Recommendations For versions prior to 4.10.0, update to version 4.10.0 to resolve the issue. As a temporary workaround, consider sanitizing the SVG when outputting it, utilizing a reliable package such as https://github.com/darylldoyle/svg-sanitizer to ensure comprehensive SVG sanitization capabilities. Restrict access to uploading SVG files to minimize the risk of exploitation until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-36828

GHSA-6R5G-CQ4Q-327G

Affected Products

Statamic

References · 12

• 🔥 https://github.com/statamic/cms/security/advisories/GHSA-6r5g-cq4q-327g · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36828.json · Exploit
• https://github.com/statamic/cms/commit/c714893ad92de6e5ede17b501003441af505b30d · Patch
• https://github.com/statamic/cms/pull/8408 · Patch
• https://osv.dev/vulnerability/GHSA-6r5g-cq4q-327g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36828 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36828 · Vendor Advisory
• https://github.com/statamic/cms · Note
• https://github.com/statamic/cms/blob/f806b6b007ddcf066082eef175653c5beaa96d60/src/Tags/Svg.php#L36-L40 · Note
• https://github.com/statamic/cms/blob/f806b6b007ddcf066082eef175653c5beaa96d60/src/Http/Controllers/CP/Fieldtypes/FilesFieldtypeController.php#L15 · Note
• https://github.com/statamic/cms/releases/tag/v4.10.0 · Note
• https://t.me/cvenotify/53696 · Telegram Post