Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-27499

CVE-2024-27499: Bagist Cross-site Scripting vulnerability

6.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-27499
GHSA ID
GHSA-w5mx-334j-6fwv
EPSS Score
0.11416%
CWE
CWE-79
Published
3/1/2024
Updated
8/2/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
bagisto/bagistocomposer< 2.1.02.1.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from two key gaps: 1) The ThemeController's store method lacked proper file validation (added in the patch via 'image|extensions' validation), allowing XSS payloads in PNGs. 2) The ThemeCustomizationRepository's uploadImage method blindly processed uploads with ImageManager, which could fail to properly sanitize malicious files (patched with try-catch and error handling). Together these enabled upload and persistence of XSS payloads that execute when viewed.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

***isto is vuln*r**l* to *ross-sit* s*riptin* (XSS) vi* pn* *il* uplo** vuln*r**ility in pro*u*t r*vi*w option.

Reasoning

T** vuln*r**ility st*mm** *rom two k*y **ps: *) T** T**m**ontroll*r's stor* m*t*o* l**k** prop*r *il* v*li**tion (***** in t** p*t** vi* 'im***|*xt*nsions' v*li**tion), *llowin* XSS p*ylo**s in PN*s. *) T** T**m**ustomiz*tionR*pository's uplo**Im***