Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the Statamic content management system (CMS), specifically affecting the HTML fieldtypes. Authenticated users who have permissions to manage fields can inject malicious JavaScript code into the HTML content. When higher-privileged users view this content, the malicious script executes in their browsers, potentially compromising their accounts or data.

The vulnerability exists in Statamic versions 5.73.8 and below, as well as versions 6.0.0-alpha.1 through 6.3.1. It has been fixed in versions 6.3.2 and 5.73.9 by introducing HTML sanitization using the DOMPurify library, which cleanses the HTML content before rendering it.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers with field management permissions to inject malicious JavaScript code that executes in the browsers of higher-privileged users. This can lead to unauthorized actions such as session hijacking, data theft, or performing actions on behalf of the victim user.

Because the attack is stored, the malicious code persists in the system and triggers whenever the affected content is viewed, increasing the risk and potential impact.

The vulnerability has a high severity score (CVSS 8.1) indicating significant confidentiality and integrity impacts, though it does not affect availability.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the Stored XSS vulnerability in Statamic CMS versions 5.73.8 and below and 6.0.0-alpha.1 through 6.3.1, you should upgrade to version 6.3.2 or 5.73.9 where the issue is fixed.

The fix involves sanitizing HTML content in the HTML fieldtype using the DOMPurify library to prevent malicious JavaScript injection.

Ensure that the HTML fieldtype configuration has sanitization enabled (which is the default setting) to automatically cleanse HTML input before rendering.

Useful 0 Not Useful 0