Reflected XSS in Serendipity CMS

Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability affecting Serendipity CMS versions 2.3.5 through 2.6.0. The flaw occurs in the search clean-URL route where a search term is reflected back into the page without proper sanitization. The issue involves incorrect sanitization logic that decodes URL-encoded HTML payloads after encoding, allowing malicious JavaScript to execute in a victim's browser when they click a crafted link.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Serendipity CMS version is between 2.3.5 and 2.6.0. Use commands like 'curl -s http://your-site.com/serendipity_version' or check the version in the admin panel. Test by visiting a crafted URL like 'http://your-site.com/search/%3Csvg/onload=alert(1)%3E' to see if JavaScript executes.

Alternatively, inspect the serveSearch() function in include/functions_routing.inc.php for improper sanitization logic where urldecode() is applied after HTML encoding.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this to execute arbitrary JavaScript in your browser when you click a malicious search link. This could lead to session hijacking, theft of cookies or sensitive data, or redirection to phishing sites. The attack requires user interaction, meaning you must click the link for it to work.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Serendipity to version 2.6.1 or later to patch the vulnerability. If upgrading is not possible, modify the sanitization logic in include/functions_routing.inc.php to decode input before applying encoding and sanitization functions.

Temporarily disable the search clean-URL route or restrict access to the /search/ endpoint until patched. Monitor for suspicious activity or unauthorized access attempts.

Useful 0 Not Useful 0