Craft CMS Entry Title Stored XSS via Drag-and-Drop

Executive Summary

This vulnerability affects Craft CMS versions 5.0.0-RC1 through 5.9.22. An author-level control panel user can insert a malicious JavaScript payload into an entry title. When an admin or any control panel user with the saveEntries permission for the same Structure section drags another entry under the malicious entry in table view, the payload executes within the victim's session.

The root cause is that the title is escaped into a data-title attribute by the server, then decoded by the browser, read using jQuery's .data('title'), and concatenated into a new HTML string without proper attribute escaping. Exploitation requires the attacker to have at least an Author role control panel account, the victim to perform a drag operation (not just visit the page), and the victim's session to have elevated permissions at the time of the trigger.

This issue was fixed in version 5.9.23.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a stored cross-site scripting (XSS) attack where a malicious JavaScript payload is injected into an entry title by an Author-level control panel user. Detection involves identifying entries with suspicious or unexpected JavaScript code in their titles, especially in Structure-type sections.

Since the exploit triggers when a user with saveEntries permissions drags an entry under a poisoned entry in table view, monitoring for unusual drag operations or unexpected script execution in the control panel could help detect exploitation attempts.

To detect the presence of malicious payloads, you can search the database or exported content for suspicious JavaScript code patterns in entry titles.

• Use a database query to find entries with suspicious script tags or JavaScript code in the title field, for example (SQL syntax may vary):
• SELECT id, title FROM entries WHERE title LIKE '%<script%' OR title LIKE '%javascript:%';
• Check web server logs or application logs for unusual POST or drag-and-drop related requests in the control panel.

There are no specific commands provided in the resources, but focusing on searching for script tags in entry titles and monitoring user actions in the control panel is recommended.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the execution of malicious JavaScript code within the session of an admin or privileged control panel user. This could allow an attacker to perform actions on behalf of the victim, potentially leading to unauthorized changes, data theft, or further compromise of the CMS environment.

Because the attack requires user interaction (dragging an entry) and elevated permissions, the impact is somewhat limited but still significant in environments where multiple users have control panel access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to execute malicious JavaScript in the session of a privileged user, potentially leading to account takeover by actions such as changing an admin's email address and resetting their password.

Such unauthorized access and control over administrative accounts could lead to unauthorized access to sensitive data managed by the CMS, which may impact compliance with data protection regulations like GDPR and HIPAA that require safeguarding personal and sensitive information.

However, the vulnerability requires an attacker to have an existing control panel account with at least Author-level permissions and the victim to perform a specific drag operation while having elevated session privileges, which somewhat limits the attack surface.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Craft CMS to version 5.9.23 or later, where the issue has been fixed.

Additionally, restrict author-level control panel users from storing untrusted JavaScript payloads in entry titles and limit drag operations in the control panel to trusted users only.

Useful 0 Not Useful 0