GHSA-rv3r-vqjj-8c76: 
PHP vulnerability analysis and mitigation

A Cross-site scripting (XSS) vulnerability was discovered in the Kirby CMS, affecting versions 3.5.7-3.7.3 of the getkirby/cms Composer package. The vulnerability was published on August 24, 2022, and allows execution of JavaScript code inside the Panel session. This security issue was assigned GHSA-rv3r-vqjj-8c76 with a High severity rating (CVSS score 7.1) (GitHub Advisory).

The vulnerability exists in the tags and multiselect fields of the Kirby CMS Panel. While the system properly escaped autocompleted tags, it failed to properly handle HTML rendering for new or edited tags and custom tags from content files. The vulnerability has been classified as CWE-79 (Cross-site Scripting) with a CVSS score of 7.1, indicating high severity. The CVSS metrics show Network attack vector, Low attack complexity, Low privileges required, No user interaction needed, Unchanged scope, High confidentiality impact, Low integrity impact, and No availability impact (GitHub Advisory).

The vulnerability allows attackers with Panel access to store malicious HTML code in tags, which would then be rendered by the browser of any victim visiting the modified page in the Panel. This could lead to privilege escalation if attackers gain access to an admin user's Panel session. The vulnerability also enables self-inflicted XSS attacks in the tags field, which could be exploited through social engineering attacks. External visitors could only exploit this vulnerability if the site allows modification of tags or multiselect fields through frontend forms (GitHub Advisory).

The vulnerability has been patched in Kirby versions 3.5.8.1, 3.6.6.1, and 3.7.4. Users are recommended to update to one of these or later versions. For those unable to update immediately, a temporary workaround involves disabling the tags and multiselect fields by uncommenting these fields from all blueprints. Note that the fixes have introduced some double escaping issues with dynamic options, which will be addressed in Kirby 3.8 (GitHub Advisory).