CVE-2024-45406: Craftcms/cms Cross-Site Scripting Vulnerability
MODERATE
Advisory Identifier:
GHSA-28h4-788g-rh42
Advisory Summary
CVE-2024-45406 is a MODERATE (CVSS 5.5) cross-site scripting vulnerability (CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)) affecting Craftcms/cms libraries in the Packagist ecosystem. The issue involves craft cms vulnerable to stored xss in breadcrumb list and title fields. Remediation is available by upgrading affected packages to version 5.1.2.
CVE-2024-45406 at a Glance
CVE Identifier
CVE-2024-45406
GHSA Identifier
GHSA-28h4-788g-rh42
Severity
MODERATE
CVSS v3.1 Base Score
5.5
CWE Classification
CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected Product
Craftcms/cms
Package Ecosystem
Packagist
Published Date
Last Updated
Security Impact
CVSS: 5.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L).
Attack Vector
Network (AV:N)
Attack Complexity
Low (AC:L)
Privileges Required
Low (PR:L)
User Interaction
Required (UI:R)
Scope
Unchanged (S:U)
Confidentiality
Low (C:L)
Integrity
Low (I:L)
Availability
Low (A:L)
How to Fix CVE-2024-45406
To remediate this vulnerability, upgrade all affected Craftcms/cms dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
craftcms/cms
fixed: 5.1.2
Upgrade craftcms/cms to 5.1.2
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for craftcms/cmsHow to Check if You Are Affected
To determine whether your application is affected by CVE-2024-45406, inspect your project dependencies for Craftcms/cms:
inspect dependencies for craftcms/cmsAnalyze the terminal output to locate any version of Craftcms/cms in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 5.1.2), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS), where the product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. In Craftcms/cms, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
### Summary
Multiple Stored XSS can be triggered by the breadcrumb list and title fields with user input.
### Details
1. In the **/admin/categories** page, category title isn't sanitized and triggered xss.
2. In the category edit page under the **/admin/categories/**, category title in breadcrumb list isn't sanitized and triggered xss.
3. In the **/admin/entries** page, entry title isn't sanitized and triggered xss.
4. In the entry edit page under the **/admin/entries/**, entry title in breadcrumb list isn't sanitized and triggered xss.
5. In the **/admin/myaccount** and pages under it, username or full name in breadcrumb list isn't sanitized and triggered xss.
### Impact
Malicious users can tamper with the control panel.
### PoC
#### 1. In the **/admin/categories** page, category title isn't sanitized and triggered xss.
```
1. Access to the Settings -> Categories ( /admin/settings/categories )
2. Create new category group
3. Access to the Categories page ( /admin/categories/ )
4. Push the New category button
5. Input the Title column : xss<script>alert('xss')</script>
6. Push the Create Category or Save button
7. Access to the Categories page again and it triggers xss
```
#### 2. In the category edit page under the **/admin/categories/**, category title in breadcrumb list isn't sanitized and triggered xss.
```
1. Access to the Settings -> Categories ( /admin/settings/categories )
2. Create new category group
3. Access to the Categories page ( /admin/categories/ )
4. Push the New category button
5. Input the Title column : xss<script>alert('xss')</script>
6. Push the Create Category or Save button
7. Access to the Category edit page again and it triggers xss
```
#### 3. In the **/admin/entries** page, entry title isn't sanitized and triggered xss.
```
1. Access to the Settings -> Entry Types ( /admin/settings/entry-types )
2. Create new entry type
3. Access to the Settings -> Sections ( /admin/settings/sections )
4. Create new section
5. Access to the Entries page ( /admin/entries )
6. Push the New entry button
7. Input the Title column : xss<script>alert('xss')</script>
8. Push the Create entry or Save button
9. Access to the Entries page again and it triggers xss
```
#### 4. In the entry edit page under the **/admin/entries/**, entry title in breadcrumb list isn't sanitized and triggered xss.
```
1. Access to the Settings -> Entry Types ( /admin/settings/entry-types )
2. Create new entry type
3. Access to the Settings -> Sections ( /admin/settings/sections )
4. Create new section
5. Access to the Entries page ( /admin/entries )
6. Push the New entry button
7. Input the Title column : xss<script>alert('xss')</script>
8. Push the Create entry or Save button
9. Access to the Entriy edit page again and it triggers xss
```
#### 5. In the **/admin/myaccount** and pages under it, username or full name in breadcrumb list isn't sanitized and triggered xss.
```
1. Access to the My Account Page ( /admin/myaccount )
2. Input the Full Name column : xss<script>alert('xss')</script>
3. Push the the Save button
4. Access to the My Account page ( /admin/myaccount ) or pages under it ( /admin/myaccount/addresses , /admin/myaccount/preferences , etc.) and it triggers xss
```
CVE-2024-45406 Affected Craftcms/cms Versions
1 component(s)
Fixed Versions:
5.1.2
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
craftcms/cms
|
Packagist |
≥ 5.0.0
< 5.1.2
|
5.1.2
|
References
GitHub Advisory / Wiki
ADVISORY
https://github.com/craftcms/cms/security/advisories/GHSA-28h4-788g-rh42
NVD — CVE-2024-45406
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45406
Security Fix Commit
FIX COMMIT
https://github.com/craftcms/cms/commit/b7348942f8131b3868ec6f46d615baae50151bb8
Craftcms/cms Source Repository
REPOSITORY
https://github.com/craftcms/cms
Frequently Asked Questions
What is CVE-2024-45406?
CVE-2024-45406 is a security vulnerability in Craftcms/cms involving Craft CMS vulnerable to stored XSS in breadcrumb list and title fields under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS).
Which Craftcms/cms versions are affected?
Affected versions include releases prior to 5.1.2 across affected packages: craftcms/cms.
What version fixes CVE-2024-45406?
Upgrading to 5.1.2 (or the latest patched release for your respective branch) resolves the vulnerability.
Is craftcms/cms affected?
Yes, craftcms/cms is affected in releases prior to 5.1.2. Upgrade your dependency to 5.1.2 or later.
What is the CVSS score of CVE-2024-45406?
CVE-2024-45406 has a CVSS v3.1 base score of 5.5 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L.
What CWE is associated with CVE-2024-45406?
CVE-2024-45406 is classified under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.).
How can I check Packagist dependencies for CVE-2024-45406?
Run the dependency tree command: 'inspect dependencies for craftcms/cms'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-28h4-788g-rh42",
"modified" : "2024-09-09T19:30:14Z",
"published" : "2024-09-09T18:18:28Z",
"aliases" : [ "CVE-2024-45406" ],
"summary" : "Craft CMS vulnerable to stored XSS in breadcrumb list and title fields",
"details" : "### Summary\nMultiple Stored XSS can be triggered by the breadcrumb list and title fields with user input.\n\n### Details\n1. In the **/admin/categories** page, category title isn't sanitized and triggered xss.\n2. In the category edit page under the **/admin/categories/**, category title in breadcrumb list isn't sanitized and triggered xss.\n3. In the **/admin/entries** page, entry title isn't sanitized and triggered xss.\n4. In the entry edit page under the **/admin/entries/**, entry title in breadcrumb list isn't sanitized and triggered xss.\n5. In the **/admin/myaccount** and pages under it, username or full name in breadcrumb list isn't sanitized and triggered xss.\n\n### Impact\nMalicious users can tamper with the control panel.\n\n### PoC\n#### 1. In the **/admin/categories** page, category title isn't sanitized and triggered xss.\n```\n1. Access to the Settings -> Categories ( /admin/settings/categories )\n2. Create new category group\n3. Access to the Categories page ( /admin/categories/ )\n4. Push the New category button\n5. Input the Title column : xss<script>alert('xss')</script>\n6. Push the Create Category or Save button\n7. Access to the Categories page again and it triggers xss\n``` \n\n\n\n\n#### 2. In the category edit page under the **/admin/categories/**, category title in breadcrumb list isn't sanitized and triggered xss.\n```\n1. Access to the Settings -> Categories ( /admin/settings/categories )\n2. Create new category group\n3. Access to the Categories page ( /admin/categories/ )\n4. Push the New category button\n5. Input the Title column : xss<script>alert('xss')</script>\n6. Push the Create Category or Save button\n7. Access to the Category edit page again and it triggers xss\n``` \n\n\n\n\n#### 3. In the **/admin/entries** page, entry title isn't sanitized and triggered xss.\n```\n1. Access to the Settings -> Entry Types ( /admin/settings/entry-types )\n2. Create new entry type\n3. Access to the Settings -> Sections ( /admin/settings/sections )\n4. Create new section\n5. Access to the Entries page ( /admin/entries )\n6. Push the New entry button\n7. Input the Title column : xss<script>alert('xss')</script>\n8. Push the Create entry or Save button\n9. Access to the Entries page again and it triggers xss\n``` \n\n\n\n\n#### 4. In the entry edit page under the **/admin/entries/**, entry title in breadcrumb list isn't sanitized and triggered xss.\n```\n1. Access to the Settings -> Entry Types ( /admin/settings/entry-types )\n2. Create new entry type\n3. Access to the Settings -> Sections ( /admin/settings/sections )\n4. Create new section\n5. Access to the Entries page ( /admin/entries )\n6. Push the New entry button\n7. Input the Title column : xss<script>alert('xss')</script>\n8. Push the Create entry or Save button\n9. Access to the Entriy edit page again and it triggers xss\n``` \n\n\n\n\n#### 5. In the **/admin/myaccount** and pages under it, username or full name in breadcrumb list isn't sanitized and triggered xss.\n```\n1. Access to the My Account Page ( /admin/myaccount )\n2. Input the Full Name column : xss<script>alert('xss')</script>\n3. Push the the Save button\n4. Access to the My Account page ( /admin/myaccount ) or pages under it ( /admin/myaccount/addresses , /admin/myaccount/preferences , etc.) and it triggers xss\n``` \n\n\n",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
}, {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "craftcms/cms"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "5.0.0"
}, {
"fixed" : "5.1.2"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/craftcms/cms/security/advisories/GHSA-28h4-788g-rh42"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-45406"
}, {
"type" : "WEB",
"url" : "https://github.com/craftcms/cms/commit/b7348942f8131b3868ec6f46d615baae50151bb8"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/craftcms/cms"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-79", "CWE-80" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2024-09-09T18:18:28Z",
"nvd_published_at" : "2024-09-09T17:15:13Z"
}
}