CVE-2024-47186
📋 TL;DR
This CVE describes a cross-site scripting (XSS) vulnerability in Filament, a Laravel development component collection. Attackers can inject malicious scripts via ColorColumn or ColumnEntry values, which execute when users view affected pages. All Filament users running versions 3.0.0 through 3.2.114 are vulnerable.
💻 Affected Systems
- Filament
📦 What is this software?
Filament by Filamentphp
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal session cookies, perform actions as authenticated users, or redirect to malicious sites, potentially leading to account compromise and data theft.
Likely Case
Attackers inject malicious scripts to steal session tokens or user data from users viewing vulnerable pages.
If Mitigated
With proper input validation and output encoding, the impact is limited to failed injection attempts.
🎯 Exploit Status
Exploitation requires ability to inject malicious values into ColorColumn or ColumnEntry fields, typically requiring some level of application access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.2.115
Vendor Advisory: https://github.com/filamentphp/filament/security/advisories/GHSA-9h9q-qhxg-89xr
Restart Required: No
Instructions:
1. Update Filament to v3.2.115 or later via Composer: composer require filament/filament:"^3.2.115" 2. Run composer update 3. Clear Laravel cache: php artisan cache:clear
🔧 Temporary Workarounds
Input Validation
allImplement strict input validation for all values passed to ColorColumn and ColumnEntry components
Output Encoding
allApply proper HTML encoding to all user-controlled data before rendering in ColorColumn or ColumnEntry
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Disable or restrict access to vulnerable pages containing ColorColumn or ColumnEntry components
🔍 How to Verify
Check if Vulnerable:
Check composer.json or run: composer show filament/filament | grep versionCheck Version:
composer show filament/filament | grep versionVerify Fix Applied:
Confirm version is v3.2.115 or higher: composer show filament/filament | grep version📡 Detection & Monitoring
Log Indicators:
- Unusual characters in ColorColumn/ColumnEntry values
- Multiple failed validation attempts on color/column fields
Network Indicators:
- Script tags or JavaScript in HTTP POST parameters to Filament endpoints
SIEM Query:
source="web_logs" AND ("ColorColumn" OR "ColumnEntry") AND ("<script>" OR "javascript:")