Angrybrad

An authorization bypass allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. This is achieved by sending a POST request to the '/actions/graphql/api' endpoint and selecting the localized field without providing the `siteId` argument, leading to the disclosure of out-of-scope site content.

An authorization bypass allows anonymous GraphQL clients to read out-of-scope section entries. By chaining next hops from a visible in-scope entry, attackers can enumerate and read titles, slugs, and custom-field content from withheld sections via the `prev` and `next` fields.

Control panel users with entry editing permissions can execute unsandboxed Twig code, which may lead to authenticated Remote Code Execution (RCE). The issue occurs during the entry saving process when strings for a signed redirect URL are compiled as a Twig template using the `renderObjectTemplate()` function instead of the sandboxed `renderSandboxedObjectTemplate()` alternative. This signed URL is derived from the `Referer` HTTP request header, which can be manipulated by an attacker.

The Google Cloud Storage for Craft CMS plugin integrates Google Cloud Storage with Craft CMS. Versions of the plugin on the 2.x branch prior to 2.2.1 allow unauthenticated users possessing a valid CSRF token to view a list of buckets the plugin has access to via the `DefaultController->actionLoadBucketData()` API endpoint. The `DefaultController->actionLoadBucketData()` endpoint is vulnerable.

Craft CMS contains a privilege escalation flaw via the `UsersController->actionImpersonateWithToken` function. A low-privilege user, or an unauthenticated user with access to a shared URL, can escalate their privileges to administrator level. This is achieved by abusing the impersonation functionality through a token-based bypass. The issue allows an attacker with a valid "preview token" to hijack requests into the impersonation endpoint, logging in as any user, including administrators, without authentication. Approximately 105,000 instances of Craft CMS are exposed globally. The vulnerability allows full admin takeover. The root cause is a bypass of security guards in the `actionPreview()` function, combined with insufficient verification of the token intended for the impersonation action. The vulnerability is exploitable by appending a crafted string to a preview URL.

The software is susceptible to a reflected cross-site scripting (XSS) issue. A fix intended to sanitize return URLs used `strip tags()`, which only removes HTML tags but does not validate URL schemes. Payloads utilizing schemes like `javascript:` or `data:` bypass this sanitization, enabling malicious code execution when the return URL is rendered in an `href` attribute. Specifically, the `setReturnUrl()` function in `src/web/User.php` is affected. The issue arises because `strip tags()` operates on HTML syntax while the threat requires URL scheme validation. Exploitation involves crafting a malicious link containing a dangerous URL, such as `https://target.example.com/?returnUrl=javascript:alert(document.cookie)`, and sending it to a victim. When the victim clicks the link, the malicious URL is stored in the session and subsequently rendered in an `href` attribute, leading to the execution of the attacker-controlled code. This can lead to session hijacking, data exfiltration, phishing, and cross-site request forgery (CSRF).

Craft CMS is a content management system. A remote code execution issue exists in the `ElementIndexesController` and `FieldsController` due to a behavior injection. To exploit this, Craft control panel administrator permissions and `allowAdminChanges` must be enabled. An attacker can leverage the same gadget chain as a previously reported advisory to achieve remote code execution.

Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at `/var/lib/php/sessions`. Such session files are named `sess [session value]`, where `[session value]` is provided to the client in a `Set-Cookie` response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server.

This is a remote code execution (RCE) vulnerability that affects Craft CMS versions 4 and 5, specifically those with compromised security keys. The vulnerability allows attackers to execute arbitrary code on the affected system, potentially leading to unauthorized access and data breaches. According to CISA, this vulnerability is being actively exploited in cyberattacks, with approximately 41,000 instances potentially affected.

An issue was discovered that allows remote attackers to cause a denial of service (DoS) via crafted strings to `Feed-Me Name` and `Feed-Me URL` fields, due to saving a feed using an Asset element type with no volume selected.

The issue allows an attacker to inject javascript code into the Volume Name, potentially leading to Cross Site Scripting (XSS) attacks. This could enable attackers to execute malicious scripts on the affected system.

Name of the Vulnerable Software and Affected Versions: craftcms version 3.1.31 Description: The issue allows remote attackers to inject arbitrary web script or HTML. This is achieved via the "/admin/settings/sites/new" API endpoint. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. Recommendations: For craftcms version 3.1.31, update to a version that contains a fix for this issue, as no specific workaround is provided for this version. At the moment, there is no information about a newer version that contains a fix for this vulnerability.