Executive Summary

CVE-2023-53890 is a stored cross-site scripting (XSS) vulnerability in Perch CMS version 3.2. Authenticated users can upload malicious SVG files that contain embedded JavaScript code. When these SVG files are viewed, the embedded scripts execute in the context of the user's browser. This happens because the application does not properly sanitize or validate the SVG file contents before storing and serving them, allowing the malicious scripts to run. [1, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute arbitrary JavaScript in the browsers of users who view the malicious SVG files. This can lead to theft of user session information, unauthorized actions performed on behalf of the user, and other client-side attacks that compromise user security and privacy. [1, 3]

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, you can check for the presence of uploaded SVG files containing embedded JavaScript code on your Perch CMS 3.2 installation. Specifically, look for SVG files in the upload directories (e.g., /perch/resources/) that include <script> tags or JavaScript payloads. Commands to find such files on a Linux server might include: 1) Searching for SVG files: `find /path/to/perch/resources/ -name '*.svg'` 2) Grepping for script tags inside SVG files: `grep -l '<script' /path/to/perch/resources/*.svg` 3) Reviewing recent uploads or changes to SVG files by date: `find /path/to/perch/resources/ -name '*.svg' -mtime -7` to check files modified in the last 7 days. Additionally, monitoring web server logs for requests to SVG files that trigger suspicious client-side behavior may help. Note that detection requires authenticated access to the CMS to verify upload activity and file contents. [3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include: 1) Restrict or disable SVG file uploads for authenticated users until a patch or fix is applied. 2) Implement server-side validation and sanitization of SVG files to remove any embedded JavaScript or script tags before storing or serving them. 3) Educate users to avoid uploading SVG files containing scripts. 4) Monitor and remove any existing malicious SVG files from the server. 5) Apply any available security updates or patches from the vendor once released. 6) Consider adding Content Security Policy (CSP) headers to limit script execution from untrusted sources. Since the vulnerability requires authenticated user upload, reviewing user permissions and access controls can also reduce risk. [1, 3]

Useful 0 Not Useful 0