JavaScript Injection in Craft CMS via GitHub Issue Title

Executive Summary

This vulnerability affects Craft CMS versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15. An attacker who only has a GitHub account can insert a malicious JavaScript payload into the title of an issue in the craftcms/cms GitHub repository.

When a Craft CMS administrator uses the CraftSupport widget's "Give feedback" screen and searches for a term that returns the poisoned issue, the malicious JavaScript payload executes within the admin's control panel session.

Importantly, the attacker does not need any control panel account or elevated privileges within Craft CMS to carry out this attack. The issue has been fixed in versions 4.17.16 and 5.9.23.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the execution of arbitrary JavaScript code in the context of a Craft CMS administrator's control panel session.

Such code execution could allow an attacker to perform actions on behalf of the administrator, potentially leading to unauthorized access, data manipulation, or compromise of the CMS environment.

Since no elevated privileges or control panel accounts are required by the attacker, the risk is significant if an administrator interacts with the compromised feedback search.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Craft CMS to version 4.17.16 or later, or version 5.9.23 or later, where the issue has been fixed.

Useful 0 Not Useful 0