Reflected XSS in REDAXO CMS via metainfo_default_fields_create API

Executive Summary

REDAXO before version 5.21.0 has a reflected cross-site scripting (XSS) vulnerability in the Metainfo API. The 'type' parameter in the metainfo_default_fields_create API is not properly sanitized, allowing authenticated attackers to inject HTML or JavaScript payloads. When a victim with a valid backend session clicks a crafted link containing a CSRF token and malicious payload, the unescaped input is rendered in rex_view::message(), executing scripts in the victim's backend session.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect REDAXO installations for versions before 5.21.0. Check the API endpoint for metainfo_default_fields_create and verify if the 'type' parameter is properly sanitized. Look for unescaped HTML in error messages rendered by rex_view::message().

Commands to check version: grep -r 'REDAXO' /path/to/installation or check the version in the admin panel. Monitor logs for suspicious API calls with the 'type' parameter containing script tags.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in your backend session if you click a specially crafted link while authenticated. Potential impacts include data theft, unauthorized actions, or disruption of the backend interface. However, exploitation requires a valid backend session and user interaction.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade REDAXO to version 5.21.0 or later immediately. If upgrading is not possible, apply input validation to sanitize the 'type' parameter in the metainfo_default_fields_create API. Ensure all user inputs are properly escaped before rendering in rex_view::message().

Restrict access to the backend interface to trusted users only. Monitor for unusual activity in the API logs and disable the Metainfo API if not required.

Useful 0 Not Useful 0