CVE-2023-53890
📋 TL;DR
Perch CMS 3.2 contains a stored cross-site scripting vulnerability where authenticated users can upload malicious SVG files containing JavaScript. When these files are viewed, the embedded scripts execute in victims' browsers, potentially stealing session cookies or performing other client-side attacks. This affects all Perch CMS 3.2 installations with file upload functionality enabled.
💻 Affected Systems
- Perch CMS
📦 What is this software?
Perch by Grabaperch
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, gain full control of the CMS, deface websites, or redirect users to malicious sites.
Likely Case
Authenticated users with upload privileges could embed tracking scripts, steal other users' session data, or perform limited client-side attacks.
If Mitigated
With proper input validation and content security policies, the impact is limited to visual defacement without script execution.
🎯 Exploit Status
Exploit requires authenticated access but is trivial to execute once authenticated. Public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.1
Vendor Advisory: https://grabaperch.com/
Restart Required: No
Instructions:
1. Backup your Perch CMS installation. 2. Download Perch CMS 3.2.1 from the official website. 3. Replace the existing installation files with the patched version. 4. Clear any cached files or assets.
🔧 Temporary Workarounds
Disable SVG file uploads
allConfigure Perch CMS to reject SVG file uploads entirely
Edit Perch configuration to remove SVG from allowed file types
Implement Content Security Policy
allAdd CSP headers to prevent inline script execution from uploaded files
Add 'Content-Security-Policy: default-src 'self'; script-src 'self'' to web server configuration
🧯 If You Can't Patch
- Restrict file upload permissions to trusted administrators only
- Implement web application firewall rules to block SVG files containing script tags
🔍 How to Verify
Check if Vulnerable:
Check if running Perch CMS version 3.2 and test if SVG files with embedded JavaScript can be uploaded and executedCheck Version:
Check Perch admin dashboard or examine perch/core/version.php fileVerify Fix Applied:
Verify installation shows version 3.2.1 and test that SVG files with script tags are either rejected or scripts don't execute📡 Detection & Monitoring
Log Indicators:
- Unusual SVG file uploads
- Multiple failed upload attempts with SVG files
- Admin user uploading files from unusual IP addresses
Network Indicators:
- HTTP POST requests uploading SVG files
- Requests to uploaded SVG files followed by suspicious outbound connections
SIEM Query:
source="web_logs" AND (uri_path="*.svg" OR file_extension="svg") AND http_method="POST"