ApostropheCMS vulnerabilities

Prior to ApostropheCMS 4.33.0 and import-export 3.7.0, import routes invoke bigUploadMiddleware without an early authorize callback. Unauthenticated requests can perform upload initialization, chunk storage, temporary processing and attacker-declared cleanup work before the later user check rejects the import.

ApostropheCMS prior to 4.33.0 has a self-service password-change endpoint that verifies the current password but does not use the login module's failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response. This is fixed in version 4.33.0.

ApostropheCMS prior to 4.33.0 has its core page REST API read full page documents with .permission(false) in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public page content by _id/slug. This is fixed in version 4.33.0.

ApostropheCMS prior to 4.33.0 has a REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) that does not apply the publicApiCheckAsync gate enforced by other read routes. An unauthenticated caller can query this route for any document _id and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read API is otherwise supposed to gate. This is fixed in version 4.33.0.

In the CAPTCHA integrations (Form, login-recaptcha, login-hcaptcha) for ApostropheCMS, the user-supplied response token is interpolated unencoded into the provider verification request. Crafted tokens can smuggle request parameters and disrupt CAPTCHA verification and CAPTCHA-gated forms or login flows. Automated bypass probing is possible, but a successful CAPTCHA bypass or secret disclosure has not been established.

Prior to db-connect 1.1.0 and ApostropheCMS 4.33.0, an account with view-draft access can submit a projection exclusion path that traverses a constructor prototype chain to a shared prototype member when a SQLite, PostgreSQL or multipostgres adapter is used. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected.

In the import-export module of ApostropheCMS before 3.7.0, an authenticated user with import access to a target type can supply an object or operator as an update-key value, causing the import query to match an unidentified existing document that the user has generic edit permission to modify. The normal findForEditing permission filter still limits candidate documents, so the issue does not permit permission-free overwrite of arbitrary protected content.

In ApostropheCMS before 4.33.0, the exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. The issue is fixed in version 4.33.0.

Prior to 4.33.0, an authenticated editor with legitimate edit rights on a pre-existing ordinary page nested under a restricted parent can use the same-parent page move operation to change sibling ranks without create authorization on that parent. The bypass is limited to sibling ordering rather than arbitrary content modification, confidentiality loss, or creation of the restricted nesting.

Prior to 4.33.0, viewRole is not applied to anonymous visitors when a developer exposes user objects through a publicly rendered relationship or expressly enabled public API. Inadequately limited templates, including serialization of an entire related user object, can conditionally disclose user fields, but password hashes are stored separately and are not affected.

Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the style attribute and inject executable attributes when published content, or an affected draft viewed by a higher-privileged user, is rendered.

ApostropheCMS prior to 4.34.0 has a getOne REST endpoint for pages that does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document _id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces both restrictions.

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an import-enabled localized type, a contributor with draft editing authority can cross the publication boundary by selecting a published document for replacement, although the current assessment is based on remediation review rather than a repeated end-to-end reproduction. This issue is fixed in version 3.7.1.

Prior to 3.7.1 of the import-export module in ApostropheCMS, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private upload storage, or authenticated upload delivery are not exposed through this network-download path.

Prior to 4.34.0, 'POST /api/v1/@apostrophecms/doc/slugTaken' with body { "slug": "target-slug" } in ApostropheCMS returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user (including editors) can enumerate the slug space of private pages, drafts, and archived content.

Prior to 4.34.0, the color field in ApostropheCMS accepts trailing content after a valid rgb() or hsl() prefix because its TinyColor validation does not require the entire value to match a color. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered, the payload executes, resulting in stored XSS.

ApostropheCMS is a Node.js content management system that, in versions up to 4.30.0, allows unauthorized modifications to object prototypes by authenticated editors. The use of the `$pullAll` operator enables writing arbitrary values to `Object.prototype`, leading to authorization bypass on all REST API endpoints.

In ApostropheCMS prior to 4.33.0 and passport-bridge prior to 1.6.1, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed token before its first use can adopt the associated session, including through the passport-bridge cross-locale flow. This is fixed in ApostropheCMS 4.33.0 and passport-bridge 1.6.1.

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification.

In the import-export module of ApostropheCMS before 3.7.0, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process. The source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write.

In ApostropheCMS before 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the special __proto__, constructor, and prototype path keys, allowing browser prototype mutation that can reach an unsafe DOM sink and execute script in the victim's session. Anonymous visitors do not load the affected admin context. The issue is fixed in version 4.33.0.

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it. Repeated large rejected uploads, using the normal public CSRF cookie, can persistently consume temporary-disk capacity and may disrupt ApostropheCMS and other services that depend on the same partition. This issue is fixed in version 4.33.0.

Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who can import an enabled content type but lacks its stronger publication role can cause import write helpers to create, replace, or remove published variants without the normal publish permission and lifecycle checks.

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failures can leave staging and extracted artifacts without unconditional cleanup. The already-hardened pre-authentication and write-error paths are separate, and current end-to-end denial-of-service impact from this residual path remains subject to maintainer validation. This issue is fixed in version 3.7.1.

Prior to 4.34.0, a public REST API type in ApostropheCMS that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump.

ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.

ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set() and apos.util.get(), allowing an authenticated editor to overwrite the shared Object.prototype.toString function's call property and cause a persistent process-wide denial of service until restart.

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and the ontext handler emits that content without escaping, while a browser parses the following img onerror markup as active HTML. This issue is fixed in version 2.17.6.

ApostropheCMS before 4.32.0 has a vulnerability in the page module's move() operation that fails to enforce the destination parent's _create permission for ordinary moves, allowing an authenticated editor or contributor to move a controlled page into a restricted subtree and re-rank protected sibling pages.

ApostropheCMS before 3.6.2 has a vulnerability in the import-export module where the attachment source path is constructed from attacker-controlled _id, name, and extension fields without ensuring the path remains under the extracted attachments directory, allowing an authenticated contributor to import a crafted archive, read a host file with an allowed extension, and publish the copied file at an unauthenticated uploads URL.

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 are vulnerable to stored cross-site scripting via unsanitized user display name in draft version tooltip.

ApostropheCMS is a Node.js content management system that in versions up to 4.29.0 has a vulnerability in the password reset process. This vulnerability allows an attacker to send a crafted reset request that results in a reset link being sent to the attacker's domain.

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authenticated server-side request forgery (SSRF) in the rich-text widget import flow, allowing an attacker to force the server to fetch attacker-controlled URLs.

ApostropheCMS version 4.29.0 has a stored XSS vulnerability in the image widget functionality. A user with the Editor role can configure an image widget link to use a javascript: URL payload, allowing a malicious widget to be published on the site.

ApostropheCMS is an open-source Node.js CMS. A regression in commit 49d0bb7, included in version 2.17.1 of the sanitize-html package, bypasses allowedTags enforcement for text inside nonTextTagsArray elements (textarea and option). ApostropheCMS 4.28.0 is affected through its dependency on the vulnerable sanitize-html version. An attacker can inject arbitrary tags including XSS payloads through any allowed option or textarea element using entity encoding. Fixed in sanitize-html 2.17.2 and ApostropheCMS 4.29.0.

In ApostropheCMS versions 4.28.0 and prior, the choices and counts query parameters in the REST API execute MongoDB distinct() operations that bypass publicApiProjection restrictions. An unauthenticated attacker can extract all distinct field values, including fields protected by viewPermission, and the counts variant reveals document counts per value.

ApostropheCMS versions 4.28.0 and prior contain a stored XSS vulnerability in the @apostrophecms/color-field module. Color values prefixed with -- bypass TinyColor validation, and launder.string() performs only type coercion without stripping HTML metacharacters. These unsanitized values are concatenated directly into <style> tags in per-widget style elements and the global stylesheet, marked as safe HTML. An editor can inject a value that closes the style tag and executes arbitrary JavaScript in the browser of every visitor.

ApostropheCMS versions 4.28.0 and prior contain an authorization bypass in the getRestQuery method of the @apostrophecms/piece-type module. An unauthenticated attacker can supply a project query parameter in a REST API request, causing publicApiProjection to be skipped and disclosing fields the administrator restricted from the public API, such as internal notes, draft content, or metadata.

ApostropheCMS versions 4.28.0 and prior contain a timing side-channel vulnerability in the password reset endpoint (/api/v1/@apostrophecms/login/reset-request) that allows unauthenticated username and email enumeration. Response time differences arise from lack of delay normalization and rate limiting. The issue is fixed in version 4.29.0.