PT-2023-26042 · Neos Cms · Neos Cms

Dlubitz · Published 2023-09-18 · Updated 2024-03-06 · CVE-2023-37611

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Neos CMS version 8.3.3

Description The issue allows a remote authenticated attacker to execute arbitrary code via a crafted SVG file uploaded to the neos/management/media component. To exploit this, the attacker must be able to upload a maliciously crafted file or coerce someone with the needed access to upload the file. The attacker can use this vulnerability to deliver malicious code. It is possible to use Content Security Policy (CSP) to protect against attacks being executed from such a file.

Recommendations For Neos CMS version 8.3.3, consider disabling the upload of SVG files to the neos/management/media component until a patch is available. Implementing Content Security Policy (CSP) can also help protect against attacks being executed from maliciously crafted files.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-NEOS-2023-37611

CVE-2023-37611

GHSA-6QJF-7G3J-QX25

Affected Products

Neos Cms

References · 17

• 🔥 https://rodelllemit.medium.com/stored-xss-in-neo-cms-8-3-3-9bd1cb973c5b · Exploit
• https://osv.dev/vulnerability/BIT-neos-2023-37611 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6qjf-7g3j-qx25 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37611 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37611 · Vendor Advisory
• https://github.com/neos/neos-development-collection/pull/4812 · Note
• https://github.com/neos/neos-development-collection/issues/4833 · Note
• https://github.com/neos/neos-development-collection · Note
• https://github.com/neos/neos-development-collection/commit/4ac0df04d2e44e164e95887b466075dde3f04045 · Note
• https://github.com/neos/neos-ui/releases/tag/8.3.4 · Note
• https://digi.ninja/blog/svg_xss.php · Note
• https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html · Note
• https://t.me/cvenotify/71168 · Telegram Post
• https://t.me/cibsecurity/70688 · Telegram Post
• https://twitter.com/CVEnew/status/1703886189692862468 · Twitter Post