GHSA-6784-9c82-vr85
Injection of arbitrary HTML/JavaScript code through the media download URL
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting (XSS) issue, which could potentially allow attackers to steal sensitive information, manipulate the website's content, or perform actions on behalf of the victim.
### Patches
The problem has not been patched yet. Users should upgrade to patched versions once they become available. Currently affected versions are:
* 2.6.4
* 2.5.20
### Workarounds
Until an official patch is released, users can implement additional input validation and output encoding for the 'slug' parameter in the MediaStreamController's downloadAction method. Alternatively, configuring a Web Application Firewall (WAF) to filter potentially malicious input could serve as a temporary mitigation.
### References
* GitHub repository: https://github.com/sulu/sulu
* Vulnerable code: https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php#L106
References
External links from the advisory. They lead to third-party sites.
- https://github.com/sulu/sulu/security/advisories/GHSA-6784-9c82-vr85
- https://nvd.nist.gov/vuln/detail/CVE-2024-47617
- https://github.com/sulu/sulu/commit/a5a5ae555d282e88ff8559d38cfb46dea7939bda
- https://github.com/sulu/sulu/commit/eeacd14b6cf55f710084788140d40ebb00314b29
- https://github.com/sulu/sulu
- https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php#L106