PT-2023-26471 · Kirby · Kirby

Dapatrese

+1

·

Published

2023-07-27

·

Updated

2023-09-06

·

CVE-2023-38490

CVSS v3.1

6.8

Medium

VectorAV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Kirby versions prior to 3.5.8.3 Kirby versions prior to 3.6.6.3 Kirby versions prior to 3.7.5.2 Kirby versions prior to 3.8.4.1 Kirby versions prior to 3.9.6
Description The issue affects Kirby sites that use the Xml data handler or the Xml::parse() method in site or plugin code. XML External Entities (XXE) is a feature in the XML markup language that allows including data from external files in an XML structure. If the name of the external file can be controlled by an attacker, this becomes a vulnerability that can be abused for various system impacts like the disclosure of internal or confidential data stored on the server or to perform network requests on behalf of the server. The Xml::parse() method used PHP's LIBXML NOENT constant, which enabled the processing of XML external entities during the parsing operation. This method is used in the Xml data handler. Both the vulnerable method and the data handler are not used in the Kirby core but may be used in site or plugin code to parse RSS feeds or other XML files. If those files are of an external origin, attackers may be able to include an external entity in the XML file that will then be processed in the parsing process.
Recommendations Update to Kirby version 3.5.8.3 or later to fix the vulnerability. Update to Kirby version 3.6.6.3 or later to fix the vulnerability. Update to Kirby version 3.7.5.2 or later to fix the vulnerability. Update to Kirby version 3.8.4.1 or later to fix the vulnerability. Update to Kirby version 3.9.6 or later to fix the vulnerability. As a temporary workaround, consider disabling the Xml::parse() method or restricting the use of the Xml data handler until a patch is available. Avoid using the Xml data handler or the Xml::parse() method with XML input controlled by an attacker.

Exploit

Fix

XML Entity Expansion

XXE

Weakness Enumeration

CWE-776CWE-611

Related Identifiers

CVE-2023-38490
GHSA-Q386-W6FG-GMGP

Affected Products

Kirby