Stored XSS in MCMS Article Content Field

Executive Summary

MCMS versions 6.1.1 through 6.2.1 have a stored Cross-Site Scripting (XSS) vulnerability in the article content field called contentDetails. The application's global XSS filter excludes this field, relying instead on a weak regex-based blacklist that misses certain XSS vectors like onmouseover. Attackers with article-save permissions can inject malicious scripts that bypass the filter and are stored in the database. When static pages are generated, these scripts are rendered without proper escaping, allowing execution in victims' browsers.

Useful 0 Not Useful 0

Detection Guidance

Check MCMS versions 6.1.1 through 6.2.1 for stored XSS in article content. Inspect static HTML files generated by the system for unsanitized payloads like <svg/onmouseover=alert(document.domain)>. Review user permissions for cms:content:save access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary scripts in your browser when visiting affected pages. This could lead to session hijacking, theft of credentials or cookies, phishing attacks, or defacement of website content. The attack requires low privileges to initiate but can affect any visitor to the compromised site.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. It may result in data breaches, unauthorized data access, or integrity violations, potentially leading to regulatory penalties and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Update MCMS to a patched version. Enable strict XSS filtering for the contentDetails field. Implement HTML escaping in static page templates. Restrict cms:content:save permissions to trusted users.

Useful 0 Not Useful 0