CVE-2024-58318
📋 TL;DR
A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts through the rich text editor component. This could enable attackers to execute arbitrary JavaScript in users' browsers when they view affected pages or forms. Organizations using Kentico Xperience with the vulnerable rich text editor component are affected.
💻 Affected Systems
- Kentico Xperience
📦 What is this software?
Xperience by Kentico
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, redirect users to malicious sites, perform actions on behalf of authenticated users, or deploy malware through the compromised application.
Likely Case
Attackers with access to content editing capabilities could inject malicious scripts that execute when other users view affected content, potentially leading to session hijacking or credential theft.
If Mitigated
With proper input validation and output encoding, malicious scripts would be neutralized before reaching users' browsers.
🎯 Exploit Status
Requires access to content editing functionality; exploitation involves injecting malicious URIs through the rich text editor
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Available via hotfix download
Vendor Advisory: https://devnet.kentico.com/download/hotfixes
Restart Required: Yes
Instructions:
1. Download the appropriate hotfix from Kentico DevNet. 2. Apply the hotfix to your Kentico Xperience installation. 3. Restart the application/services. 4. Test the rich text editor functionality.
🔧 Temporary Workarounds
Disable rich text editor for untrusted users
allRestrict access to the rich text editor component to trusted administrators only
Implement content security policy
allAdd Content-Security-Policy headers to restrict script execution
Content-Security-Policy: script-src 'self'
🧯 If You Can't Patch
- Implement strict input validation on all rich text editor inputs
- Enable output encoding for all content rendered from the rich text editor
🔍 How to Verify
Check if Vulnerable:
Test if malicious scripts can be injected through the rich text editor and persist when content is saved and reloadedCheck Version:
Check Kentico Xperience administration panel for version informationVerify Fix Applied:
Attempt to inject malicious scripts through the rich text editor after applying the hotfix; scripts should be neutralized or prevented📡 Detection & Monitoring
Log Indicators:
- Unusual content submissions through rich text editor
- Suspicious script tags or JavaScript in content storage
Network Indicators:
- Unexpected external script loads from application pages
- Suspicious redirects from application URLs
SIEM Query:
Search for content containing script tags, javascript: URIs, or on* event handlers in application content logs