-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| getformwork/formwork | composer | < 2.2.0 | 2.2.0 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability is a stored Cross-Site Scripting (XSS) issue within the Formwork CMS, specifically affecting the blog tags functionality. The root cause of this vulnerability is the improper handling of user-supplied input, which is then rendered into the web page without adequate sanitization. The application uses the innerHTML property to display user-provided content, such as blog tags, filenames, and search queries. This allows an attacker to inject malicious HTML and JavaScript code, which gets stored on the server and executed in the browser of any user viewing the compromised content.
The investigation of the provided patch https://github.com/getformwork/formwork/pull/791 confirms this analysis. The patch addresses the vulnerability by replacing the unsafe usage of innerHTML with the safer innerText property in multiple locations. The innerText property treats the input as plain text, preventing the browser from interpreting it as HTML. In cases where HTML rendering is required, the patch introduces and uses a new escapeHtml function to sanitize the input before it is rendered. This comprehensive approach of replacing innerHTML and adding escaping where necessary effectively mitigates the XSS vulnerability across different components of the application, including the TagsInput, UploadInput, and Pages views.
TagsInput.insertTagpanel/src/ts/components/inputs/tags-input.ts
UploadInput.updateDropTargetLabelpanel/src/ts/components/inputs/upload-input.ts
Pages.handleSearchpanel/src/ts/components/views/pages.ts
Ongoing coverage of React2Shell