CVE-2020-11083: 
PHP vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was discovered in October CMS versions from 1.0.319 and before version 1.0.466. The vulnerability allows a user with access to a markdown FormWidget to create a stored XSS attack against themselves and any other users with access to the generated HTML from the field (GitHub Advisory). The issue was discovered on March 31, 2020, and was fixed in version 1.0.466. For users of the RainLab.Blog plugin, this was also fixed in version 1.4.1.

The vulnerability (CVE-2020-11083) is related to the markdown FormWidget functionality that stores data persistently. The issue stems from insufficient validation and sanitization of user-provided markdown content that gets converted to HTML. When a user with appropriate permissions creates or edits content using the markdown editor, the application failed to properly sanitize the input, allowing for the injection of malicious HTML and JavaScript code. The vulnerability has a CVSS v3.1 Base Score of 4.8 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows authenticated users with access to markdown fields to create stored XSS attacks that could affect themselves and other users who have access to view the generated HTML content. This could lead to the execution of arbitrary client-side code in the context of other users' sessions, potentially including administrators (Full Disclosure).

The vulnerability can be exploited by an authenticated user with 'Manage the blog posts' permission. The attacker can inject malicious payloads into blog post content, which gets executed when other users view the post. The exploit has been demonstrated in the wild, with proof-of-concept code showing how attackers could potentially steal cookies or perform actions in the context of the victim's session (Packet Storm).

The vulnerability was patched in October CMS version 1.0.466 by introducing a new permission 'backend.allow_unsafe_markdown' that restricts the ability to store JavaScript in markdown to only users explicitly granted this permission. For RainLab.Blog plugin users, the fix was implemented in version 1.4.1. As a workaround for users unable to upgrade, they can manually apply the patches from the commits (October Commit, RainLab Blog Commit).