Listen to this Post
The vulnerability CVE-2024-34080 in Formwork CMS stems from a failure to sanitize user-supplied input within the blog tag field before it is permanently stored and subsequently rendered in the administrative interface. An attacker with authenticated access can craft a malicious tag containing a JavaScript payload. When this tag is saved, the payload is persistently stored in the database. The critical flaw occurs when an administrator views or edits the compromised blog post; the malicious script is executed within their browser session without any sanitization. This attack is particularly severe because any attempt to remove the malicious tag triggers the XSS payload again, as the script executes during the page load of the edit interface. This creates a persistent lockout condition, preventing the removal of the malicious tag and allowing continued attacker control over the admin session.
Platform: Formwork CMS
Version: <= 1.12.2
Vulnerability: Stored XSS
Severity: Critical
date: 2024-04-15
Prediction: Patch by 2024-05-10
What Undercode Say:
curl -X POST http://<target>/admin/pages/<page>/edit -d "tags[]=<script>alert('XSS')</script>" -H "Cookie: <admin_cookie>"
<img src=x onerror=alert(document.cookie)>
How Exploit:
Crafted tag payload executes script in admin context. Prevents tag management via persistent re-execution. Leads to admin session compromise.
Protection from this CVE
Update to version 1.12.3. Sanitize all tag input. Implement Content Security Policy.
Impact:
Admin session hijacking. Interface lockout. Unauthorized administrative actions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
