CVE-2023-38488: 
PHP vulnerability analysis and mitigation

CVE-2023-38488 is a field injection vulnerability discovered in Kirby, a content management system, affecting versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6. The vulnerability affects Kirby sites with authenticated Panel users or those allowing external visitors to update content files. The issue was discovered and reported in June 2023 and publicly disclosed on July 27, 2023 (GitHub Advisory).

The vulnerability exists in the KirbyData text storage handler implementation where content is stored in text files using Kirby's KirbyData format. The vulnerability stems from the way the system handles Unicode BOM sequences in field separators. When reading a KirbyData file, the code first removed the Unicode BOM sequence from the file contents before splitting the content into fields. However, when writing, field separators containing a Unicode BOM sequence (e.g., --\xEF\xBB\xBF--) were not properly detected, allowing attackers to inject unauthorized field data. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 HIGH by NVD and 7.1 HIGH by GitHub (NVD).

The vulnerability allows attackers with content write access to overwrite content fields that were not intended to be modified. This can be exploited to alter site content, break site behavior, or inject malicious data or code. The vulnerability specifically affects fields in the content file that were defined above the vulnerable user-writable field or not defined at all (GitHub Advisory).

The vulnerability has been patched in versions 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6. The fix modifies the code to only remove the Unicode BOM sequence at the beginning of the file, addressing the vulnerability for both newly written and existing content files. Users are strongly advised to upgrade to one of these patched versions (GitHub Release).

The vulnerability was responsibly reported by Patrick Falb (@dapatrese) at FORMER 03. The vendor responded by releasing security patches across multiple version branches and providing detailed documentation about the vulnerability (GitHub Advisory).