Description (CNA)
Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default permissive trustedHosts configuration, an attacker can poison the Host or X-Forwarded-Host header to manipulate the application’s $baseUrl. This bypasses the endpoint’s internal URL validation, forcing the backend Guzzle client to fetch a malicious payload from an attacker-controlled server and reflect it to the client with a Content-Type: application/javascript header. The vulnerability manifests when assetManager.cacheSourcePaths is set to false. This issue has been fixed in versions 4.18.0 and 5.10.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| craftcms / cms | affected >= 5.0.0-RC1, < 5.10.0; affected >= 4.0.0-RC1, < 4.18.0 |
CWE
CWE-918, CWE-644, CWE-79
References
- https://github.com/craftcms/cms/security/advisories/GHSA-c55v-343g-5xff
- https://github.com/craftcms/cms/pull/18559
ADP enrichment
No English description supplied.
No references supplied.