Alexander-Schranz

The issue concerns a PHP content management system where access to pages is granted regardless of role permissions for webspaces with a security system configured and permission check enabled. Webspaces without this configuration do not have this issue. The problem is patched in versions 2.4.17 and 2.5.13.

Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name. The HTML is executed when the tag name is listed in the auto complete form. Only admin users can create tags so they are the only ones affected.

Name of the Vulnerable Software and Affected Versions: Sulu versions prior to 1.6.44 Sulu versions prior to 2.2.18 Sulu versions prior to 2.3.8 Sulu version prior to 2.4.0 Description: Sulu is an open-source PHP content management system based on the Symfony framework. An attacker can read arbitrary local files via a PHP file include. In a default configuration, this also leads to remote code execution. The compromised components include arbitrary file read on the server and potential remote code execution. Exploitation requires a user account on the backend. Recommendations: For versions prior to 1.6.44, update to version 1.6.44 or later. For versions prior to 2.2.18, update to version 2.2.18 or later. For versions prior to 2.3.8, update to version 2.3.8 or later. For version prior to 2.4.0, update to version 2.4.0 or later. As a temporary workaround for users unable to upgrade, overwrite the service `sulu route.generator.expression token provider` and wrap the translator before passing it to the expression language.

Name of the Vulnerable Software and Affected Versions: Sulu versions 2.0.0-RC1 through 2.2.17 Sulu versions 2.3.0 through 2.3.7 Sulu versions 2.4.0 before the patch Description: Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions, Sulu users who have access to any subset of the admin UI are able to elevate their privilege. Over the API, it was possible for them to give themselves permissions to areas which they did not already have. This issue was introduced with the new `ProfileController` `putAction`. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. Recommendations: For Sulu versions 2.0.0-RC1 through 2.2.17, update to version 2.2.18 or later. For Sulu versions 2.3.0 through 2.3.7, update to version 2.3.8 or later. For Sulu version 2.4.0, apply the patch to the `ProfileController` manually until a patched version is available. As a temporary workaround, consider patching the `ProfileController` of affected Sulu versions by overwriting it.

Name of the Vulnerable Software and Affected Versions: Jackalope Doctrine-DBAL versions prior to 1.7.4 Description: The issue allows users to provoke SQL injections if they can specify a node name or query. This is because the jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths. Node names and xpaths can contain " or ; according to the JCR specification. If queries are never done from user input, or if you validate the user input to not contain ;, you are not affected. Recommendations: Upgrade to version 1.7.4 to resolve this issue. If that is not possible, escape all places where `$property` is used to filter `sv:name` in the class `JackalopeTransportDoctrineDBALQueryQOMWalker`: `XPath::escape($property)`. As a temporary workaround, consider validating user input to not contain ; to minimize the risk of exploitation.

The issue is related to stored cross-site scripting attacks due to improper sanitization of HTML input into Tag names. This occurs when the HTML is executed when the tag name is listed in the auto-complete form. Only admin users are affected, as they are the only ones allowed to create tags.

The issue is related to the lack of protection of the web page structure in the Sulu content management system, allowing a remote attacker to conduct cross-site scripting attacks. A logged-in admin user can add a script injection in the collection title, which can be executed. The problem is patched in version 1.6.41.