PT-2024-28785 · Automad · Automad

Jerry Thomas + 1 · Published 2024-08-23 · Updated 2025-04-21 · CVE-2024-40111

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Automad version 2.0.0-alpha.4

Description A persistent (stored) cross-site scripting (XSS) vulnerability has been identified in Automad. This vulnerability enables an attacker to inject malicious JavaScript code into the template body. The injected code is stored within the flat file CMS and is executed in the browser of any user visiting the forum.

Recommendations For Automad version 2.0.0-alpha.4, patch immediately and validate user input to prevent malicious script injection. As a temporary workaround, consider restricting access to the template body to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-40111

GHSA-G8H2-J9PM-4XX2

Affected Products

Automad

References · 11

• 🔥 https://drive.google.com/file/d/10BVQKYo2H1-Nx3FOGteL2xww4lbZ3xlS/view?usp=sharing · Exploit
• 🔥 https://github.com/w3bn00b3r/Stored-Cross-Site-Scripting-XSS---Automad-2.0.0-alpha.4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-40111 · Security Note
• https://osv.dev/vulnerability/GHSA-g8h2-j9pm-4xx2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-40111 · Vendor Advisory
• https://github.com/marcantondahmen/automad · Note
• https://t.me/cvedetector/4043 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1827111296367468732 · Twitter Post
• https://twitter.com/oktsec/status/1827122235456270585 · Twitter Post
• https://t.me/cvenotify/119159 · Telegram Post
• https://twitter.com/CVEnew/status/1827091974244950237 · Twitter Post