Skip to content

XSS in various backend modules due to (un)escaping in JS notification module

Moderate
kdambekalns published GHSA-jfxf-4frr-9j3q May 18, 2022

Package

composer neos/neos (Composer)

Affected versions

>3.3

Patched versions

5.3.10, 7.0.9, 7.1.7, 7.2.6, 7.3.4, 8.0.2

Description

The notification module displaying flash messages unscapes HTML coming from the server, resulting in XSS vulnerabilities with various names and labels of entities (eg. workspace title or media title). This however means you must be a logged in user with respective rights in the first place to leverage the attack vector.

See https://www.neos.io/blog/xss-in-various-backend-modules.html and https://discuss.neos.io/t/neos-bugfix-releases-5-3-10-7-0-9-7-1-7-7-2-6-7-3-4-8-0-2/5930?u=kdambekalns

Severity

Moderate

CVE ID

No known CVE

Weaknesses

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as <, >, and & that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. Learn more on MITRE.