CVE-2020-4041
📋 TL;DR
This stored XSS vulnerability in Bolt CMS allows attackers to inject malicious JavaScript into uploaded filenames after initial upload by renaming files. Attackers can circumvent filename extension restrictions. All Bolt CMS instances before version 3.7.1 are affected.
💻 Affected Systems
- Bolt CMS
📦 What is this software?
Bolt by Boltcms
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, deface websites, or redirect users to malicious sites through stored XSS payloads in filenames.
Likely Case
Attackers with user accounts could inject XSS payloads that affect other users viewing file listings, potentially stealing credentials or performing limited malicious actions.
If Mitigated
With proper input validation and output encoding, malicious scripts would be rendered harmless as text rather than executed code.
🎯 Exploit Status
Exploitation requires authenticated user access. Public exploit details available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.7.1
Vendor Advisory: https://github.com/bolt/bolt/security/advisories/GHSA-68q3-7wjp-7q3j
Restart Required: No
Instructions:
1. Backup your Bolt CMS installation and database. 2. Update to Bolt CMS version 3.7.1 or later via composer: 'composer require bolt/core:^3.7.1'. 3. Clear cache if needed.
🔧 Temporary Workarounds
Disable file renaming
allTemporarily disable file renaming functionality for all users
Implement filename sanitization
allAdd custom validation to sanitize filenames before storage
🧯 If You Can't Patch
- Restrict file upload permissions to trusted users only
- Implement web application firewall rules to block XSS payloads in filenames
🔍 How to Verify
Check if Vulnerable:
Check Bolt CMS version in admin panel or via 'composer show bolt/core' commandCheck Version:
composer show bolt/core | grep versionsVerify Fix Applied:
Confirm version is 3.7.1 or later and test file renaming with XSS payloads📡 Detection & Monitoring
Log Indicators:
- File rename operations with suspicious characters (<, >, script, javascript) in filenames
- Multiple failed rename attempts with special characters
Network Indicators:
- HTTP requests with XSS payloads in filename parameters
SIEM Query:
source="web_logs" AND (filename CONTAINS "<script>" OR filename CONTAINS "javascript:")🔗 References
- http://packetstormsecurity.com/files/158299/Bolt-CMS-3.7.0-XSS-CSRF-Shell-Upload.html
- http://seclists.org/fulldisclosure/2020/Jul/4
- https://github.com/bolt/bolt/commit/b42cbfcf3e3108c46a80581216ba03ef449e419f
- https://github.com/bolt/bolt/pull/7853
- https://github.com/bolt/bolt/security/advisories/GHSA-68q3-7wjp-7q3j
- http://packetstormsecurity.com/files/158299/Bolt-CMS-3.7.0-XSS-CSRF-Shell-Upload.html
- http://seclists.org/fulldisclosure/2020/Jul/4
- https://github.com/bolt/bolt/commit/b42cbfcf3e3108c46a80581216ba03ef449e419f
- https://github.com/bolt/bolt/pull/7853
- https://github.com/bolt/bolt/security/advisories/GHSA-68q3-7wjp-7q3j
