PT-2024-22350 · Contao · Contao

Leofeyer · Published 2024-04-09 · Updated 2025-01-17 · CVE-2024-28235

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Contao versions 4.9.0 through 4.13.39 Contao versions 5.0.0 through 5.3.3

Description The issue arises when checking for broken links on protected pages, causing Contao to send the cookie header to external URLs. The passed options for the HTTP client are used for all requests.

Recommendations For Contao versions 4.9.0 through 4.13.39, update to Contao 4.13.40. For Contao versions 5.0.0 through 5.3.3, update to Contao 5.3.4. As a temporary workaround for all affected versions, consider disabling crawling protected pages to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-28235

GHSA-9JH5-QF84-X6PR

Affected Products

Contao

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28235.json · Exploit
• https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16 · Patch
• https://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6pr · Vendor Advisory
• https://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3d · Patch
• https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-28235 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9jh5-qf84-x6pr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28235 · Security Note
• https://github.com/contao/contao · Note
• https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129 · Note
• https://twitter.com/CVEnew/status/1777732829998436716 · Twitter Post
• https://twitter.com/cracbot/status/1777930914665812195 · Twitter Post
• https://t.me/cvenotify/107771 · Telegram Post
• https://t.me/cvenotify/76179 · Telegram Post