CVE-2023-48701
📋 TL;DR
This vulnerability allows attackers to upload HTML files disguised as images in Statamic CMS, bypassing MIME type validation. This affects front-end forms with asset fields and authenticated control panel users. Successful exploitation could lead to cross-site scripting (XSS) attacks.
💻 Affected Systems
- Statamic CMS
📦 What is this software?
Statamic by Statamic
Statamic by Statamic
⚠️ Risk & Real-World Impact
Worst Case
An attacker could upload malicious HTML files that execute JavaScript in victims' browsers, potentially leading to session hijacking, credential theft, or complete account compromise.
Likely Case
Attackers upload HTML files that execute XSS payloads, potentially stealing user sessions or performing actions on behalf of authenticated users.
If Mitigated
With proper input validation and content security policies, the impact is limited to file uploads that don't execute malicious code.
🎯 Exploit Status
Exploitation requires access to front-end forms with asset uploads or authenticated control panel access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.15 or 4.36.0
Vendor Advisory: https://github.com/statamic/cms/security/advisories/GHSA-8jjh-j3c2-cjcv
Restart Required: No
Instructions:
1. Update Statamic CMS to version 3.4.15 (for v3) or 4.36.0 (for v4). 2. Verify the update completed successfully. 3. Test file upload functionality.
🔧 Temporary Workarounds
Disable front-end file uploads
allTemporarily disable file upload functionality on front-end forms until patching is possible.
Implement additional file validation
allAdd server-side file type validation beyond MIME checking to verify actual file content.
🧯 If You Can't Patch
- Restrict file upload permissions to trusted users only
- Implement Content Security Policy (CSP) headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check Statamic CMS version via admin panel or composer.json. Versions below 3.4.15 (for v3) or 4.36.0 (for v4) are vulnerable.Check Version:
php artisan statamic:versionVerify Fix Applied:
After updating, attempt to upload an HTML file with image extension to verify it's properly rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads with mismatched extensions/MIME types
- Multiple failed upload attempts with HTML content
Network Indicators:
- HTTP POST requests to upload endpoints with suspicious file types
SIEM Query:
source="web_logs" AND (method="POST" AND uri CONTAINS "/upload" AND (file_extension="html" OR file_extension="htm"))🔗 References
- https://github.com/statamic/cms/releases/tag/v3.4.15
- https://github.com/statamic/cms/releases/tag/v4.36.0
- https://github.com/statamic/cms/security/advisories/GHSA-8jjh-j3c2-cjcv
- https://github.com/statamic/cms/releases/tag/v3.4.15
- https://github.com/statamic/cms/releases/tag/v4.36.0
- https://github.com/statamic/cms/security/advisories/GHSA-8jjh-j3c2-cjcv
