PT-2024-27344 · Formwork · Formwork

Kyokito1412 · Published 2024-06-07 · Updated 2024-06-11 · CVE-2024-37160

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Formwork versions prior to 1.13.1

Description Formwork is a flat file-based Content Management System (CMS) that allows an attacker with administrator privileges to execute arbitrary web scripts by modifying site options via /panel/options/site. This type of attack is suitable for persistence, affecting visitors across all pages (except the dashboard). The issue is a Stored XSS vulnerability, which enables attackers to inject malicious JavaScript or HTML through a crafted payload, achieving persistence and potentially attacking numerous visitors.

Recommendations For versions prior to 1.13.1, update to Formwork 1.13.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /panel/options/site endpoint to minimize the risk of exploitation. Additionally, avoid using the description field in the site options to prevent potential injection of malicious scripts.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-37160

GHSA-5PXR-7M4J-JJC6

Affected Products

Formwork

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37160.json · Exploit
• 🔥 https://github.com/getformwork/formwork/security/advisories/GHSA-5pxr-7m4j-jjc6 · Exploit
• https://github.com/getformwork/formwork/commit/9d471204f7ebb51c3c27131581c2b834315b5e0b · Patch
• https://github.com/getformwork/formwork/commit/f5312015a5a5e89b95ef2bd07e496f8474d579c5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-37160 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37160 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5pxr-7m4j-jjc6 · Vendor Advisory
• https://github.com/getformwork/formwork · Note
• https://t.me/cvenotify/82288 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1799120398614753440 · Twitter Post