CVE-2020-35125: 
PHP vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was discovered in the forms component of Mautic before version 3.2.4. The vulnerability, identified as CVE-2020-35125, was discovered in December 2020 and patched in January 2021. The vulnerability affects all versions of Mautic prior to versions 2.16.5 and 3.2.4, allowing remote attackers to inject executable JavaScript via mautic[return] parameter (Mautic Advisory, Github Advisory).

The vulnerability exists in the way Mautic handles referrer information in forms. When a lead submits a form or downloads an asset, Mautic captures and stores the HTTP Referer header. A malicious actor could manipulate this header to include an XSS payload, which would then be stored by Mautic and executed when legitimate users view pages where referrer data is displayed. The vulnerability received a CVSS v3.1 base score of 9.6 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (NVD, Horizon3 Research).

The vulnerability is considered highly critical with a risk rating of 22/25. When exploited, it allows unauthenticated attackers to gain admin privileges leading to remote code execution on the server hosting Mautic. At the time of discovery, approximately 6,000 instances of Mautic were potentially vulnerable to this attack (Horizon3 Research).

The vulnerability can be exploited by an unauthenticated attacker by manipulating the HTTP Referer header or the mautic[return] form variable to include malicious JavaScript code. When combined with other application features, this could lead to creation of unauthorized admin users and potential remote code execution through custom theme uploads (Horizon3 Research).

Users are strongly urged to update to Mautic versions 2.16.5 or 3.2.4 immediately. For those unable to update, patch files are available for both 2.x and 3.x versions. Additionally, administrators can scan their systems for potential exploit attempts by running specific SQL queries to check for suspicious entries in the companies, form submissions, and asset downloads tables (Mautic Advisory).

The Mautic security team responded promptly to the vulnerability report, working with the researchers to develop and release patches within approximately one month of the initial disclosure. The vulnerability was discovered and reported by Naveen Sunkavally at Horizon3.ai, demonstrating effective cooperation between security researchers and the open-source community (Horizon3 Research).