Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS03bThnLWZwcnItNDdmeM4AA5Ej

phpMyFAQ vulnerable to stored XSS on attachments filename

Summary

Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leading to allow execute JavaScript code in client side (XSS)

Details

On that snippet code of rendering the file attachments from user tables

<?php foreach ($crumbs as $item) : ?>
        <tr id="attachment_<?= $item->id ?>" title="<?= $item->thema ?>">
          <td><?= $item->id ?></td>
          <td><?= $item->filename ?></td>
          <td><?= $item->record_lang ?></td>
          <td><?= Utils::formatBytes($item->filesize) ?></td>
          <td><?= $item->mime_type ?></td>
          <td>

The data directly rendering with short hand echo without any sanitation first, its recommend to use existing class of Strings::htmlentities on use phpMyFAQ\Strings;

<td><?= Strings::htmlentities($item->filename); ?></td>
<td><?= Strings::htmlentities($item->record_lang); ?></td>
<td><?= Utils::formatBytes($item->filesize) ?></td>
<td><?= Strings::htmlentities($item->mime_type); ?></td>

Propose fixing on that pull request https://github.com/thorsten/phpMyFAQ/pull/2827

PoC

  1. An attacker with permission will upload the attachments image on http://{base_url}/admin/?action=editentry
  2. On endpoint of ajax upload image POST /admin/index.php?action=ajax&ajax=att&ajaxaction=upload
  3. Change the originally name file on parameters filename to a XSS payload
  4. The XSS will trigger on attachment pages /admin/?action=attachments

Impact

This vulnerability will allow an attacker with a permissions of uploading an attachment to storing the payload of XSS on database specific table faqattachment columns filename.

The XSS payload could be rendering on page that listing the file on tables, and impact to others user that on the hierarchy.

The payload XSS have several attack scenario such like

  1. Stealing the cookies (isn’t possible since HttpOnly)
  2. Crashing the application with a looping javascript payload
Permalink: https://github.com/advisories/GHSA-7m8g-fprr-47fx
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03bThnLWZwcnItNDdmeM4AA5Ej
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 20 days ago
Updated: 20 days ago


CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Identifiers: GHSA-7m8g-fprr-47fx, CVE-2024-24574
References:

Affected Packages

packagist:phpmyfaq/phpmyfaq
Versions: < 3.2.5
Fixed in: 3.2.5