CVE-2023-44393
📋 TL;DR
A reflected XSS vulnerability in Piwigo's admin interface allows attackers to inject malicious JavaScript via crafted URLs. Only authenticated administrators are affected when they visit malicious links containing payloads in the plugin_id parameter. This could lead to session hijacking or administrative account compromise.
💻 Affected Systems
- Piwigo
📦 What is this software?
Piwigo by Piwigo
Piwigo by Piwigo
Piwigo by Piwigo
Piwigo by Piwigo
⚠️ Risk & Real-World Impact
Worst Case
Administrator account takeover leading to full system compromise, data theft, or malware installation on the server.
Likely Case
Session hijacking allowing attacker to perform administrative actions, install malicious plugins, or modify gallery content.
If Mitigated
Limited impact if administrators follow security best practices and don't click suspicious links.
🎯 Exploit Status
Exploitation requires social engineering to get admin to click malicious link. No authentication bypass needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 14.0.0beta4 and later
Vendor Advisory: https://github.com/Piwigo/Piwigo/security/advisories/GHSA-qg85-957m-7vgg
Restart Required: No
Instructions:
1. Backup your Piwigo installation and database. 2. Download Piwigo 14.0.0beta4 or later from official sources. 3. Replace all files with new version. 4. Run the upgrade script if prompted.
🔧 Temporary Workarounds
Input Sanitization
allManually sanitize plugin_id parameter in admin.php
Edit admin.php to add htmlspecialchars() or similar sanitization for plugin_id parameter
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Educate administrators to never click untrusted links while logged in
🔍 How to Verify
Check if Vulnerable:
Check if Piwigo version is below 14.0.0beta4 in admin dashboard or by examining version files.Check Version:
Check include/constants.php for PIWIGO_VERSION or view admin dashboard version info.Verify Fix Applied:
After upgrade, test that plugin_id parameter values are properly escaped in the admin plugins page.📡 Detection & Monitoring
Log Indicators:
- Unusual plugin_id parameter values in admin.php access logs
- Multiple failed plugin installation attempts
Network Indicators:
- HTTP requests to admin.php with suspicious plugin_id parameters containing script tags
SIEM Query:
web.url:*admin.php* AND web.query:plugin_id=*<script*🔗 References
- https://github.com/Piwigo/Piwigo/commit/cc99c0f1e967c5f1722a0cce30ff42374a7bbc23
- https://github.com/Piwigo/Piwigo/security/advisories/GHSA-qg85-957m-7vgg
- https://github.com/Piwigo/Piwigo/commit/cc99c0f1e967c5f1722a0cce30ff42374a7bbc23
- https://github.com/Piwigo/Piwigo/security/advisories/GHSA-qg85-957m-7vgg
