Vulnerability-Lookup

CVE-2024-47069 (GCVE-0-2024-47069)

Vulnerability from cvelistv5 – Published: 2024-09-23 15:30 – Updated: 2024-09-23 16:09

Title

Oveleon Cookiebar reflected Cross-site Scripting vulnerability

Summary

Oveleon Cookie Bar is a cookie bar is for the Contao Open Source CMS and allows a visitor to define cookie & privacy settings for the website. Prior to versions 1.16.3 and 2.1.3, the `block/locale` endpoint does not properly sanitize the user-controlled `locale` input before including it in the backend's HTTP response, thereby causing reflected cross-site scripting. Versions 1.16.3 and 2.1.3 contain a patch for the vulnerability.

Severity ?

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/oveleon/contao-cookiebar/secur…	x_refsource_CONFIRM
	https://github.com/oveleon/contao-cookiebar/commi…	x_refsource_MISC
	https://cheatsheetseries.owasp.org/cheatsheets/Cr…	x_refsource_MISC
	https://github.com/oveleon/contao-cookiebar/blob/…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	oveleon	contao-cookiebar	Affected: < 1.16.3 Affected: >= 2.0.0, < 2.1.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:oveleon:contao-cookiebar:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "contao-cookiebar",
            "vendor": "oveleon",
            "versions": [
              {
                "lessThan": "1.16.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "2.1.3",
                "status": "affected",
                "version": "2.0.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47069",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-23T16:02:04.714890Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-23T16:09:53.133Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "contao-cookiebar",
          "vendor": "oveleon",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.16.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.1.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Oveleon Cookie Bar is a cookie bar is for the Contao Open Source CMS and allows a visitor to define cookie \u0026 privacy settings for the website. Prior to versions 1.16.3 and 2.1.3, the `block/locale` endpoint does not properly sanitize the user-controlled `locale` input before including it in the backend\u0027s HTTP response, thereby causing reflected cross-site scripting. Versions 1.16.3 and 2.1.3 contain a patch for the vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-23T15:30:02.984Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/oveleon/contao-cookiebar/security/advisories/GHSA-296q-rj83-g9rq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/oveleon/contao-cookiebar/security/advisories/GHSA-296q-rj83-g9rq"
        },
        {
          "name": "https://github.com/oveleon/contao-cookiebar/commit/1d57470be5878f66d5e1e23f624dd387564b9b8d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oveleon/contao-cookiebar/commit/1d57470be5878f66d5e1e23f624dd387564b9b8d"
        },
        {
          "name": "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html"
        },
        {
          "name": "https://github.com/oveleon/contao-cookiebar/blob/2.x/src/Controller/CookiebarController.php",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oveleon/contao-cookiebar/blob/2.x/src/Controller/CookiebarController.php"
        }
      ],
      "source": {
        "advisory": "GHSA-296q-rj83-g9rq",
        "discovery": "UNKNOWN"
      },
      "title": "Oveleon Cookiebar reflected Cross-site Scripting vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47069",
    "datePublished": "2024-09-23T15:30:02.984Z",
    "dateReserved": "2024-09-17T17:42:37.029Z",
    "dateUpdated": "2024-09-23T16:09:53.133Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47069",
      "date": "2026-04-28",
      "epss": "0.01137",
      "percentile": "0.78452"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47069\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-09-23T16:15:07.160\",\"lastModified\":\"2024-09-30T13:40:36.460\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Oveleon Cookie Bar is a cookie bar is for the Contao Open Source CMS and allows a visitor to define cookie \u0026 privacy settings for the website. Prior to versions 1.16.3 and 2.1.3, the `block/locale` endpoint does not properly sanitize the user-controlled `locale` input before including it in the backend\u0027s HTTP response, thereby causing reflected cross-site scripting. Versions 1.16.3 and 2.1.3 contain a patch for the vulnerability.\"},{\"lang\":\"es\",\"value\":\"Oveleon Cookie Bar es una barra de cookies para el CMS de c\u00f3digo abierto Contao y permite que un visitante defina la configuraci\u00f3n de privacidad y cookies para el sitio web. Antes de las versiones 1.16.3 y 2.1.3, el punto de conexi\u00f3n `block/locale` no desinfecta correctamente la entrada `locale` controlada por el usuario antes de incluirla en la respuesta HTTP del backend, lo que provoca un error de cross-site scripting reflejado. Las versiones 1.16.3 y 2.1.3 contienen un parche para la vulnerabilidad.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oveleon:cookiebar:*:*:*:*:*:cantao:*:*\",\"versionEndExcluding\":\"1.16.3\",\"matchCriteriaId\":\"FFD4696B-4747-49FA-BA81-DA7C1EA0AF56\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oveleon:cookiebar:*:*:*:*:*:cantao:*:*\",\"versionStartIncluding\":\"2.0.0\",\"versionEndExcluding\":\"2.1.3\",\"matchCriteriaId\":\"96D39411-CBD8-4C7C-B87C-0B737CF8522E\"}]}]}],\"references\":[{\"url\":\"https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Technical Description\"]},{\"url\":\"https://github.com/oveleon/contao-cookiebar/blob/2.x/src/Controller/CookiebarController.php\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\"]},{\"url\":\"https://github.com/oveleon/contao-cookiebar/commit/1d57470be5878f66d5e1e23f624dd387564b9b8d\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/oveleon/contao-cookiebar/security/advisories/GHSA-296q-rj83-g9rq\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47069\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-23T16:02:04.714890Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:oveleon:contao-cookiebar:*:*:*:*:*:*:*:*\"], \"vendor\": \"oveleon\", \"product\": \"contao-cookiebar\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.16.3\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.0.0\", \"lessThan\": \"2.1.3\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-23T16:08:43.331Z\"}}], \"cna\": {\"title\": \"Oveleon Cookiebar reflected Cross-site Scripting vulnerability\", \"source\": {\"advisory\": \"GHSA-296q-rj83-g9rq\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"oveleon\", \"product\": \"contao-cookiebar\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.16.3\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.0.0, \u003c 2.1.3\"}]}], \"references\": [{\"url\": \"https://github.com/oveleon/contao-cookiebar/security/advisories/GHSA-296q-rj83-g9rq\", \"name\": \"https://github.com/oveleon/contao-cookiebar/security/advisories/GHSA-296q-rj83-g9rq\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/oveleon/contao-cookiebar/commit/1d57470be5878f66d5e1e23f624dd387564b9b8d\", \"name\": \"https://github.com/oveleon/contao-cookiebar/commit/1d57470be5878f66d5e1e23f624dd387564b9b8d\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html\", \"name\": \"https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/oveleon/contao-cookiebar/blob/2.x/src/Controller/CookiebarController.php\", \"name\": \"https://github.com/oveleon/contao-cookiebar/blob/2.x/src/Controller/CookiebarController.php\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Oveleon Cookie Bar is a cookie bar is for the Contao Open Source CMS and allows a visitor to define cookie \u0026 privacy settings for the website. Prior to versions 1.16.3 and 2.1.3, the `block/locale` endpoint does not properly sanitize the user-controlled `locale` input before including it in the backend\u0027s HTTP response, thereby causing reflected cross-site scripting. Versions 1.16.3 and 2.1.3 contain a patch for the vulnerability.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-09-23T15:30:02.984Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47069\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-23T16:09:53.133Z\", \"dateReserved\": \"2024-09-17T17:42:37.029Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-09-23T15:30:02.984Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-296Q-RJ83-G9RQ

Vulnerability from github – Published: 2024-07-26 14:28 – Updated: 2024-09-23 19:12

Summary

Reflected Cross Site-Scripting (XSS) in Oveleon Cookiebar

Details

usd-2024-0009 | Reflected XSS in Oveleon Cookiebar

Details

Advisory ID: usd-2024-0009 Product: Cookiebar
Affected Version: 2.X
Vulnerability Type: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Security Risk: HIGH, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
Vendor URL: https://www.usd.de/
Vendor acknowledged vulnerability: Yes
Vendor Status: Fixed
CVE Number: Not requested yet
CVE Link: Not requested yet
First Published: Published
Last Update: 2024-07-29

Affected Component

The block function in CookiebarController.php.

Desciption

Oveleon's Cookiebar is an extension for the popular Contao CMS. The block/locale endpoint does not properly sanitize the user-controlled locale input before including it in the backend's HTTP response, thereby causing reflected XSS.

Proof of Concept

The vulnerability could be triggered by entering the following Link:

https://[redacted].de/cookiebar/block/dens82w%22%3E%3Cimg%20src%3da%20onerror%3dalert(1)%3Ew9qt
n/[id]?redirect=https%3A%2F%2F[...]amp%3Biv_load_policy%3D3%26amp%3Bmo
destbranding%3D1%26amp%3Brel%3D0

It is likely related to the following function in the Oveleon Cookiebar source code:

    /**
     * Block content
     *
     * @Route("/cookiebar/block/{locale}/{id}", name="cookiebar_block")
     */
    public function block(Request $request, string $locale, int $id): Response
    {
        System::loadLanguageFile('tl_cookiebar', $locale);

        $this->framework->initialize();

        $objCookie = CookieModel::findById($id);

        if (null === $objCookie || null === $request->headers->get('referer'))
        {
            throw new PageNotFoundException();
        }

        $strUrl = $request->get('redirect');

        // Protect against XSS attacks
        if(!Validator::isUrl($strUrl))
        {
            return new Response('The redirect destination must be a valid URL.', Response::HTTP_BAD_REQUEST);
        }

        $objTemplate = new FrontendTemplate($objCookie->blockTemplate ?: 'ccb_element_blocker');

        $objTemplate->language = $locale;
        $objTemplate->id = $objCookie->id;
        $objTemplate->title = $objCookie->title;
        $objTemplate->type = $objCookie->type;
        $objTemplate->iframeType = $objCookie->iframeType;
        $objTemplate->description = $objCookie->blockDescription;
        $objTemplate->redirect = $request->get('redirect');
        $objTemplate->acceptAndDisplayLabel = $this->translator->trans('tl_cookiebar.acceptAndDisplayLabel', [], 'contao_default', $locale);

        return $objTemplate->getResponse();
    }

Fix

Sanitize the locale input to prevent XSS payloads from being executed in a user's browser.

References

https://github.com/oveleon/contao-cookiebar/blob/2.x/src/Controller/CookiebarController.php
https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

Timeline

2024-04-24: Vulnerability discovered by DR of usd AG.
2024-07-25: Probable cause of the vulnerability has been identified as Oveleon's Cookiebar Extension for Contao CMS.
2024-07-25: Vulnerability disclosed via GitHub Vulnerability Report.

Credits

This security vulnerability was identified by DR of usd AG.

About usd Security Advisories

In order to protect businesses against hackers and criminals, we always have to keep our skills and knowledge up to date. Thus, security research is just as important for our work as is building up a security community to promote the exchange of knowledge. After all, more security can only be achieved if many individuals take on the task.

Our CST Academy and our usd HeroLab are essential parts of our security mission. We share the knowledge we gain in our practical work and our research through training courses and publications. In this context, the usd HeroLab publishes a series of papers on new vulnerabilities and current security issues.

Always for the sake of our mission: "more security."

https://www.usd.de

Disclaimer

The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible.

Severity ?

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.1 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "oveleon/contao-cookiebar"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.16.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "oveleon/contao-cookiebar"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-47069"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-26T14:28:26Z",
    "nvd_published_at": "2024-09-23T16:15:07Z",
    "severity": "MODERATE"
  },
  "details": "## usd-2024-0009 | Reflected XSS in Oveleon Cookiebar\n\n### Details\n**Advisory ID**: usd-2024-0009 \n**Product**: Cookiebar   \n**Affected Version**: 2.X  \n**Vulnerability Type**: CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)   \n**Security Risk**: HIGH, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N   \n**Vendor URL**: https://www.usd.de/    \n**Vendor acknowledged vulnerability**: Yes    \n**Vendor Status**: Fixed   \n**CVE Number**: Not requested yet    \n**CVE Link**: Not requested yet    \n**First Published**: Published  \n**Last Update**: 2024-07-29\n\n\n### Affected Component\n\nThe `block` function in `CookiebarController.php`.\n\n\n### Desciption\n\nOveleon\u0027s Cookiebar is an extension for the popular Contao CMS.\nThe `block/locale` endpoint does not properly sanitize the user-controlled `locale` input before including it in the backend\u0027s HTTP response, thereby causing reflected XSS.\n\n### Proof of Concept\nThe vulnerability could be triggered by entering the following Link:\n\n```\nhttps://[redacted].de/cookiebar/block/dens82w%22%3E%3Cimg%20src%3da%20onerror%3dalert(1)%3Ew9qt\nn/[id]?redirect=https%3A%2F%2F[...]amp%3Biv_load_policy%3D3%26amp%3Bmo\ndestbranding%3D1%26amp%3Brel%3D0\n```\n\nIt is likely related to the following function in the Oveleon Cookiebar source code:\n\n```php\n    /**\n     * Block content\n     *\n     * @Route(\"/cookiebar/block/{locale}/{id}\", name=\"cookiebar_block\")\n     */\n    public function block(Request $request, string $locale, int $id): Response\n    {\n        System::loadLanguageFile(\u0027tl_cookiebar\u0027, $locale);\n\n        $this-\u003eframework-\u003einitialize();\n\n        $objCookie = CookieModel::findById($id);\n\n        if (null === $objCookie || null === $request-\u003eheaders-\u003eget(\u0027referer\u0027))\n        {\n            throw new PageNotFoundException();\n        }\n\n        $strUrl = $request-\u003eget(\u0027redirect\u0027);\n\n        // Protect against XSS attacks\n        if(!Validator::isUrl($strUrl))\n        {\n            return new Response(\u0027The redirect destination must be a valid URL.\u0027, Response::HTTP_BAD_REQUEST);\n        }\n\n        $objTemplate = new FrontendTemplate($objCookie-\u003eblockTemplate ?: \u0027ccb_element_blocker\u0027);\n\n        $objTemplate-\u003elanguage = $locale;\n        $objTemplate-\u003eid = $objCookie-\u003eid;\n        $objTemplate-\u003etitle = $objCookie-\u003etitle;\n        $objTemplate-\u003etype = $objCookie-\u003etype;\n        $objTemplate-\u003eiframeType = $objCookie-\u003eiframeType;\n        $objTemplate-\u003edescription = $objCookie-\u003eblockDescription;\n        $objTemplate-\u003eredirect = $request-\u003eget(\u0027redirect\u0027);\n        $objTemplate-\u003eacceptAndDisplayLabel = $this-\u003etranslator-\u003etrans(\u0027tl_cookiebar.acceptAndDisplayLabel\u0027, [], \u0027contao_default\u0027, $locale);\n\n        return $objTemplate-\u003egetResponse();\n    }\n```\n\n### Fix\nSanitize the `locale` input to prevent XSS payloads from being executed in a user\u0027s browser.\n\n\n### References\n- https://github.com/oveleon/contao-cookiebar/blob/2.x/src/Controller/CookiebarController.php\n- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html\n\n\n### Timeline\n* **2024-04-24**: Vulnerability discovered by DR of usd AG.\n* **2024-07-25**: Probable cause of the vulnerability has been identified as Oveleon\u0027s Cookiebar Extension for Contao CMS.\n* **2024-07-25**: Vulnerability disclosed via GitHub Vulnerability Report.\n\n\n### Credits\nThis security vulnerability was identified by DR of usd AG.\n\n\n### About usd Security Advisories\nIn order to protect businesses against hackers and criminals, we always have to keep our skills and knowledge up to date. Thus, security research is just as important for our work as is building up a security community to promote the exchange of knowledge. After all, more security can only be achieved if many individuals take on the task.\n\nOur CST Academy and our usd HeroLab are essential parts of our security mission. We share the knowledge we gain in our practical work and our research through training courses and publications. In this context, the usd HeroLab publishes a series of papers on new vulnerabilities and current security issues. \n\nAlways for the sake of our mission: \"more security.\"\n\nhttps://www.usd.de\n\n\n### Disclaimer\nThe information provided in this security advisory is provided \"as is\" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible.",
  "id": "GHSA-296q-rj83-g9rq",
  "modified": "2024-09-23T19:12:07Z",
  "published": "2024-07-26T14:28:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/oveleon/contao-cookiebar/security/advisories/GHSA-296q-rj83-g9rq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47069"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oveleon/contao-cookiebar/commit/1d57470be5878f66d5e1e23f624dd387564b9b8d"
    },
    {
      "type": "WEB",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/oveleon/contao-cookiebar"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oveleon/contao-cookiebar/blob/2.x/src/Controller/CookiebarController.php"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Reflected Cross Site-Scripting (XSS) in Oveleon Cookiebar"
}

FKIE_CVE-2024-47069

Vulnerability from fkie_nvd - Published: 2024-09-23 16:15 - Updated: 2024-09-30 13:40

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html	Technical Description
security-advisories@github.com	https://github.com/oveleon/contao-cookiebar/blob/2.x/src/Controller/CookiebarController.php	Product
security-advisories@github.com	https://github.com/oveleon/contao-cookiebar/commit/1d57470be5878f66d5e1e23f624dd387564b9b8d	Patch
security-advisories@github.com	https://github.com/oveleon/contao-cookiebar/security/advisories/GHSA-296q-rj83-g9rq	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	oveleon	cookiebar	*
	oveleon	cookiebar	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oveleon:cookiebar:*:*:*:*:*:cantao:*:*",
              "matchCriteriaId": "FFD4696B-4747-49FA-BA81-DA7C1EA0AF56",
              "versionEndExcluding": "1.16.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oveleon:cookiebar:*:*:*:*:*:cantao:*:*",
              "matchCriteriaId": "96D39411-CBD8-4C7C-B87C-0B737CF8522E",
              "versionEndExcluding": "2.1.3",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Oveleon Cookie Bar is a cookie bar is for the Contao Open Source CMS and allows a visitor to define cookie \u0026 privacy settings for the website. Prior to versions 1.16.3 and 2.1.3, the `block/locale` endpoint does not properly sanitize the user-controlled `locale` input before including it in the backend\u0027s HTTP response, thereby causing reflected cross-site scripting. Versions 1.16.3 and 2.1.3 contain a patch for the vulnerability."
    },
    {
      "lang": "es",
      "value": "Oveleon Cookie Bar es una barra de cookies para el CMS de c\u00f3digo abierto Contao y permite que un visitante defina la configuraci\u00f3n de privacidad y cookies para el sitio web. Antes de las versiones 1.16.3 y 2.1.3, el punto de conexi\u00f3n `block/locale` no desinfecta correctamente la entrada `locale` controlada por el usuario antes de incluirla en la respuesta HTTP del backend, lo que provoca un error de cross-site scripting reflejado. Las versiones 1.16.3 y 2.1.3 contienen un parche para la vulnerabilidad."
    }
  ],
  "id": "CVE-2024-47069",
  "lastModified": "2024-09-30T13:40:36.460",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-09-23T16:15:07.160",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Technical Description"
      ],
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/oveleon/contao-cookiebar/blob/2.x/src/Controller/CookiebarController.php"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/oveleon/contao-cookiebar/commit/1d57470be5878f66d5e1e23f624dd387564b9b8d"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/oveleon/contao-cookiebar/security/advisories/GHSA-296q-rj83-g9rq"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-47069 (GCVE-0-2024-47069)

GHSA-296Q-RJ83-G9RQ

usd-2024-0009 | Reflected XSS in Oveleon Cookiebar

Details

Affected Component

Desciption

Proof of Concept

Fix

References

Timeline

Credits

About usd Security Advisories

Disclaimer

FKIE_CVE-2024-47069

Tags

Sightings

Nomenclature