CVE-2024-24570: 
PHP vulnerability analysis and mitigation

Statamic, a Laravel and Git powered CMS, was found to contain a Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-24570. The vulnerability allows HTML files crafted to look like jpg files to be uploaded, enabling XSS attacks. This security issue affects front-end forms with asset fields without mime type validation, asset fields in the control panel, and the asset browser in the control panel. The vulnerability was discovered on January 6, 2024, by Niklas Schilling from SEC Consult Vulnerability Lab (SEC Advisory, GitHub Advisory).

The vulnerability allows attackers to bypass file extension restrictions by uploading HTML files with a .jpg extension. The system analyzes the file's content and correctly interprets it as HTML, replacing the initial .jpg extension with .html. Since no additional checks are performed on the newly set file extension, the file appears as a valid submission in Statamic's Forms page. When an authenticated user accesses this submission, any included JavaScript code will be executed. The vulnerability affects Statamic CMS versions below 4.46.0 and below 3.4.17. The CVSS v3.1 base score for this vulnerability is 8.2 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N (GitHub Advisory).

The vulnerability can lead to account takeover through a sophisticated attack chain. When exploited, an attacker can craft a malicious file that, when viewed by an admin user, can extract CSRF tokens, user information, and password reset codes. This information can then be used to reset the victim's password, effectively taking control of their account (SEC Advisory).

The vulnerability has been patched in Statamic versions 4.46.0 and 3.4.17. The vendor has disabled the copy password reset link functionality while maintaining the ability to trigger password reset emails. Users are strongly advised to update to these patched versions immediately. Additionally, the vendor recommends implementing a correctly configured Content Security Policy (CSP) as described in Statamic's documentation (GitHub Advisory).