CVE-2020-35128
📋 TL;DR
CVE-2020-35128 is a stored cross-site scripting (XSS) vulnerability in Mautic that allows attackers with company management permissions to inject malicious scripts, potentially compromising other users, including administrators. This can lead to unauthorized actions such as password changes, email alterations, or adding new administrators. Users of Mautic versions before 3.2.4 are affected.
💻 Affected Systems
- Mautic
📦 What is this software?
Mautic by Acquia
Mautic by Acquia
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains full administrative control, modifies user credentials, adds new admins, and potentially takes over the entire Mautic instance, leading to data breaches or system compromise.
Likely Case
Attackers with existing low-level permissions exploit the vulnerability to escalate privileges, perform unauthorized actions on user accounts, and steal sensitive data.
If Mitigated
With strict access controls and input validation, impact is limited to isolated user account tampering without full system takeover.
🎯 Exploit Status
Exploitation requires authenticated access with company management privileges; public advisories and proof-of-concepts are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.4
Vendor Advisory: https://forum.mautic.org/t/security-release-for-all-versions-of-mautic-prior-to-2-16-5-and-3-2-4/17786
Restart Required: No
Instructions:
1. Backup your Mautic instance. 2. Update Mautic to version 3.2.4 or later via the admin panel or manual upgrade. 3. Verify the update by checking the version in the admin interface.
🔧 Temporary Workarounds
Restrict Company Management Permissions
allLimit access to company management features to trusted administrators only to reduce attack surface.
Implement Content Security Policy (CSP)
linuxDeploy a CSP to block external script execution, mitigating XSS attacks.
Add 'Content-Security-Policy' header in web server configuration, e.g., for Apache: Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
For Nginx: add_header Content-Security-Policy "default-src 'self'; script-src 'self';";
🧯 If You Can't Patch
- Isolate the Mautic instance in a segmented network to limit access and potential lateral movement.
- Monitor and audit user activities, especially company management actions, for suspicious behavior.
🔍 How to Verify
Check if Vulnerable:
Check the Mautic version in the admin panel under 'System Info' or via the database; if version is below 3.2.4, it is vulnerable.Check Version:
In Mautic admin, navigate to System Info or run: grep -i 'version' /path/to/mautic/app/config/parameters.php (if file exists)Verify Fix Applied:
After updating, confirm the version is 3.2.4 or higher in the admin panel and test company management features for XSS payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual company management activities, such as frequent edits or script injections in company fields
- HTTP requests with suspicious JavaScript payloads in parameters
Network Indicators:
- Outbound connections to external domains from Mautic instance, potentially loading malicious scripts
SIEM Query:
Example: source="mautic_logs" AND (event="company_edit" OR event="company_create") AND (message="*script*" OR message="*javascript*")🔗 References
- https://forum.mautic.org/c/announcements/16
- https://forum.mautic.org/t/security-release-for-all-versions-of-mautic-prior-to-2-16-5-and-3-2-4/17786
- https://labs.bishopfox.com/advisories/mautic-version-3.2.2
- https://forum.mautic.org/c/announcements/16
- https://forum.mautic.org/t/security-release-for-all-versions-of-mautic-prior-to-2-16-5-and-3-2-4/17786
- https://labs.bishopfox.com/advisories/mautic-version-3.2.2
