Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-24807

CVE-2024-24807: Sulu HTML Injection via Autocomplete Suggestion

4.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-24807
GHSA ID
GHSA-gfrh-gwqc-63cv
EPSS Score
0.73692%
CWE
CWE-79
Published
2/5/2024
Updated
2/5/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
sulu/sulucomposer>= 2.0.0, < 2.4.162.4.16
sulu/sulucomposer>= 2.5.0, < 2.5.122.5.12

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the combination of: 1) User-controlled input (tag names) being directly inserted into HTML via replaceAll, and 2) Use of React's dangerouslySetInnerHTML which bypasses XSS protections. The patch replaces this dangerous pattern with safe React element composition. The pre-patch code clearly shows the vulnerable pattern in the highlightedText generation and rendering logic.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t It is *n issu* w**n input *TML into t** T** n*m*. T** *TML is *x**ut* w**n t** t** n*m* is list** in t** *uto *ompl*t* *orm. Only **min us*rs *r* *****t** *n* only **min us*rs **n *r**t* t**s. ### P*t***s _**s t** pro*l*m ***n p*t****?

Reasoning

T** vuln*r**ility st*ms *rom t** *om*in*tion o*: *) `Us*r`-*ontroll** input (t** n*m*s) **in* *ir**tly ins*rt** into *TML vi* `r*pl****ll`, *n* *) Us* o* `R***t`'s `**n**rouslyS*tInn*r*TML` w*i** *yp*ss*s XSS prot**tions. T** p*t** r*pl***s t*is **n*
CVE-2024-24807: Sulu Tag Autocomplete XSS Flaw | Miggo