Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact When running on servers that are configured to accept a wildcard as a hostname (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. See the following resources for more information on Host Header Poisoning: - https://portswigger.net/web-security/host-header - https://dzone.com/articles/what-is-a-host-header-attack Patches A feature has been added in v1.1.2 to allow a set of trusted hosts to be specified in the application. Workarounds - Apply https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6 & https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0 to your installation manually if unable to upgrade to v1.1.2. - Check that the configuration setting cms.linkPolicy is set to force. Alternative Workaround Check to make sure that your web server does not accept any hostname when serving your web application.…
Recommended action: Upgrade to 1.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Backend users with access to upload files were permitted to upload SVG files without any sanitization applied to the uploaded files. Since SVG files support being parsed as HTML by browsers, this means that they could theoretically upload Javascript that would be executed on a path under the website's domain (i.e. /storage/app/media/evil.svg), but they would have to convince their target to visit that location directly in the target's browser as the backend does not display SVGs inline anywhere, SVGs are only displayed as image resources in the backend and are thus unable to be executed. Patches Issue has been patched in Build 469 (v1.0.469) & v1.1.0. Workarounds Apply https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4 to your installation manually if unable to upgrade to Build 469 or v1.1.0. References Reported by Hoan Hoang For more information If you have any questions or comments about this advisory: Email us at hello@octobercms.com…
Recommended action: Upgrade to 1.0.469 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Backend users with the default "Publisher" system role have access to create & manage users where they can choose which role the new user has. This means that a user with "Publisher" access has the ability to escalate their access to "Developer" access. Patches Issue has been patched in Build 470 (v1.0.470) & v1.1.1. Workarounds Apply https://github.com/octobercms/october/commit/78a37298a4ed4602b383522344a31e311402d829 to your installation manually if unable to upgrade to Build 470 or v1.1.1. References Reported by Hoan Hoang For more information If you have any questions or comments about this advisory: Email us at hello@octobercms.com Threat assessment: <img width="1098" alt="Screen Shot 2020-10-10 at 1 37 25 PM" src="https://user-images.githubusercontent.com/7253840/95663611-e6326c80-0afd-11eb-8a1e-8b767a7202fb.png"
Recommended action: Upgrade to 1.0.470 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. Patches Issue has been patched in Build 466 (v1.0.466) & RainLab.Blog v1.4.1 by restricting the ability to store JS in markdown to only users that have been explicitly granted the backend.allowunsafemarkdown permission. Workarounds Apply https://github.com/octobercms/october/commit/9ecfb4867baae14a0d3f99f5b5c1e8a979ae8746 & https://github.com/rainlab/blog-plugin/commit/6ae19a6e16ef3ba730692bc899851342c858bb94 to your installation manually if unable to upgrade to Build 466 or v1.4.1 of RainLab.Blog (if using that plugin). References Reported by Sivanesh Ashok For more information If you have any questions or comments about this advisory: Email us at hello@octobercms.com Threat assessment: <img width="1100" alt="Screen Shot 2020-03-31 at 2 01 52 PM"…
Recommended action: Upgrade to 1.0.466 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack. Patches Issue has been patched in Build 467 (v1.0.467). Workarounds Apply https://github.com/octobercms/october/commit/b384954a29b89117e1c0d6035b3ede4f46df67c5 to your installation manually if unable to upgrade to Build 467. References - https://research.securitum.com/the-curious-case-of-copy-paste/ For more information If you have any questions or comments about this advisory: Email us at hello@octobercms.com Threat Assessment Assessed as Low given that by the nature of the attack it can only impact users that do it to themselves by copying and pasting from malicious websites. Acknowledgements Thanks to Michał Bentkowski of Securitum for finding the original issue in Froala and @tomaszstrojny for reporting the issue to the October CMS team.
Recommended action: Upgrade to 1.0.467 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Any users with the ability to modify any data that could eventually be exported as a CSV file from the ImportExportController could potentially introduce a CSV injection into the data to cause the generated CSV export file to be malicious. This requires attackers to achieve the following before a successful attack can be completed: 1. Have found a vulnerability in the victim's spreadsheet software of choice. 2. Control data that would potentially be exported through the ImportExportController by a theoretical victim. 3. Convince the victim to export above data as a CSV and run it in vulnerable spreadsheet software while also bypassing any sanity checks by said software. Patches Issue has been patched in Build 466 (v1.0.466). Workarounds Apply https://github.com/octobercms/library/commit/c84bf03f506052c848f2fddc05f24be631427a1a & https://github.com/octobercms/october/commit/802d8c8e09a2b342649393edb6d3ceb958851484 to your installation manually if unable to upgrade to Build 466.…
Recommended action: Upgrade to 1.0.466 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A user with the ability to use the import functionality of the ImportExportController behavior could be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question Patches Issue has been patched in Build 466 (v1.0.466). Workarounds Apply https://github.com/octobercms/october/commit/cd0b6a791f995d86071a024464c1702efc50f46c to your installation manually if unable to upgrade to Build 466. References Reported by Sivanesh Ashok For more information If you have any questions or comments about this advisory: Email us at hello@octobercms.com Threat assessment: <img width="1100" alt="Screen Shot 2020-03-31 at 2 01 52 PM" src="https://user-images.githubusercontent.com/7253840/78070158-8f7ef580-7358-11ea-950c-226533f6a0a3.png"
Recommended action: Upgrade to 1.0.466 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.