Authenticated XSS in Spina CMS v2.21.0

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Spina CMS v2.21.0 and earlier. An authenticated staff user can inject malicious JavaScript code via the rich-text editor. The payload executes when the page is viewed by visitors or administrators. The flaw bypasses the SafeUrlValidator, which only runs when embeds are saved through the admin embed form, but rich text content skips this validation. When the page renders, the embed is rebuilt without validation and output via a link_to helper, allowing a javascript: URL to execute.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Spina CMS rich-text fields for suspicious JavaScript URLs or payloads. Check page content for unexpected scripts or links with javascript: in URLs. Review server logs for unusual requests to admin pages or sensitive endpoints from public visitors.

Useful 0 Not Useful 0

Impact Analysis

An attacker with a CMS account can inject a payload that executes when a visitor views the public page. This enables session hijacking, CSRF token extraction, and unauthorized actions. For example, an attacker could steal session cookies, perform actions on behalf of users, or redirect users to malicious sites.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized data access, or manipulation, leading to compliance violations and potential legal penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Spina CMS to the latest version that includes fixes for this vulnerability. If an update is unavailable, disable rich-text embeds or apply a temporary patch re-enforcing URL validation in Embeddable.from_json or sanitizing output in RichTextPresenter.

Useful 0 Not Useful 0