Stored XSS in Edito CMS via Profile Endpoint

Executive Summary

Edito CMS has a Stored Cross-Site Scripting (XSS) vulnerability due to improper input validation. An authenticated attacker can inject malicious scripts into the givenName and surname parameters via the /api/auth/profile endpoint. When an administrator views the admin changelog logs, the injected script executes automatically in their browser.

Useful 0 Not Useful 0

Detection Guidance

Check Edito CMS logs for suspicious activity in the /api/auth/profile endpoint, particularly modifications to givenName or surname parameters. Monitor admin changelog logs for unexpected script content. Inspect network traffic for unauthorized POST requests to this endpoint.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary scripts in the context of an administrator's browser session. This could lead to session hijacking, unauthorized actions, or theft of sensitive data if the administrator accesses the changelog logs.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations using Edito CMS may face compliance risks if attackers exploit this to access or manipulate protected data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to Edito CMS version 5.10.2607 or apply hotfixes for older versions like 5.8. If immediate upgrade isn't possible, restrict access to the /api/auth/profile endpoint and review user permissions for the changelog logs.

Useful 0 Not Useful 0