GHSA-296q-rj83-g9rq: Reflected Cross Site-Scripting (XSS) in Oveleon Cookiebar
usd-2024-0009 | Reflected XSS in Oveleon Cookiebar
Details
Advisory ID: usd-2024-0009
Product: Cookiebar
Affected Version: 2.X
Vulnerability Type: CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
Security Risk: HIGH, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
Vendor URL: https://www.usd.de/
CVE Number: Not requested yet
CVE Link: Not requested yet
Affected Component
The block function in CookiebarController.php.
Desciption
Oveleon’s Cookiebar is an extension for the popular Contao CMS.
The block/locale endpoint does not properly sanitize the user-controlled locale input before including it in the backend’s HTTP response, thereby causing reflected XSS.
Fix
Sanitize the locale input to prevent XSS payloads from being executed in a user’s browser.
Timeline
2024-04-24: Vulnerability discovered by Daniel Ruppel of usd AG.
2024-07-25: Probable cause of the vulnerability has been identified as Oveleon’s Cookiebar Extension for Contao CMS.
2024-07-25: Vulnerability disclosed via GitHub Vulnerability Report.
References
- cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
- github.com/advisories/GHSA-296q-rj83-g9rq
- github.com/oveleon/contao-cookiebar
- github.com/oveleon/contao-cookiebar/blob/2.x/src/Controller/CookiebarController.php
- github.com/oveleon/contao-cookiebar/commit/1d57470be5878f66d5e1e23f624dd387564b9b8d
- github.com/oveleon/contao-cookiebar/security/advisories/GHSA-296q-rj83-g9rq
Code Behaviors & Features
Detect and mitigate GHSA-296q-rj83-g9rq with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →