October CMS vulnerabilities

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely, and the exploit is now public.

October CMS through 1.0.428 does not prevent the use of .htaccess in themes, allowing remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a .htaccess file.

October CMS version 412 is vulnerable to PHP object injection in asset move functionality, allowing for the deletion of files limited by file permissions on the server.

October CMS version 412 is vulnerable to PHP code execution in the file upload functionality, potentially leading to site compromise and possibly affecting other applications on the server.

October CMS version 412 is vulnerable to file path modification in asset move functionality, potentially allowing the creation of malicious files on the server.

October CMS version 412 is vulnerable to PHP code execution in the asset manager functionality, potentially leading to site compromise and possibly affecting other applications on the server.

October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality, potentially leading to site compromise and affecting other applications on the server.

October CMS versions prior to 3.7.17 and 4.2.21 contain a PHP object injection vulnerability in the system module. The backend `SessionMaker` trait stored widget session state as `base64(serialize(...))` and consumed it with `unserialize()` without an `allowed_classes` restriction, allowing attacker-controlled bytes to trigger object injection and reachable PHP gadget chains. This issue only affects installations with `cms.safe_mode` enabled, which is an opt-in feature for demo or multi-tenant scenarios.

A vulnerability in the October CMS system module's Twig sandbox security policy allowed a chained bypass when cms.safe_mode is enabled. By combining unrestricted access to the Laravel session store with unblocked raw SQL methods reachable through Eloquent's __call forwarding, a backend user with CMS markup editing access could read arbitrary database values and write to the backend authentication session key, forging a session as another existing user. The issue is patched in versions 3.7.17 and 4.2.21.

In October CMS prior to 3.7.16 and 4.1.16, fine-grained sub-permission checks for asset and blueprint file operations were not enforced in the CMS and Tailor editor extensions. Backend users granted editor access but explicitly denied editor.cms_assets or editor.tailor_blueprints could still create, delete, rename, move, and upload files. A related operator precedence error in Tailor navigation also disclosed the theme blueprint directory tree.

In October CMS prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping. The vulnerability is fixed in 3.7.16 and 4.1.16.

October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a vulnerability was identified in the Twig sandbox security policy that allowed database write operations when cms.safe_mode is enabled. Backend users with Developer permissions could use Twig template markup to execute insert, update, and delete operations on any database table through the query builder, which is included in the sandbox allow-list. This vulnerability is fixed in 3.7.14 and 4.1.10.

October CMS versions prior to 3.7.14 and 4.1.10 contain a server-side information disclosure vulnerability in the handling of CSS preprocessor files. Backend users with Editor permissions could craft .less, .sass, or .scss files that leverage the compiler's import functionality to read arbitrary files from the server, even with cms.safe_mode enabled. The vulnerability is fixed in 3.7.14 and 4.1.10.

October CMS versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting vulnerability in the SVG sanitization logic. The regex pattern used to strip event handler attributes could be bypassed using a crafted payload, allowing malicious SVG files to be uploaded through the Media Manager with embedded JavaScript. Exploitation could lead to privilege escalation if a superuser views or embeds the malicious SVG, and requires authenticated backend access with media upload permissions.

October CMS before versions 3.7.14 and 4.1.10 contains a server-side information disclosure vulnerability in the INI settings parser. PHP's parse_ini_string() supports ${} syntax for environment variable interpolation, allowing attackers with Editor access to inject patterns like ${APP_KEY}, leading to exposure of sensitive environment variables.

October CMS versions prior to 3.7.14 and 4.1.10 contain a stored XSS vulnerability in the Event Log mail preview. HTML content was rendered in an iframe without proper sandboxing, allowing JavaScript execution in the viewer's browser context.

October CMS versions prior to 3.7.14 and 4.1.10 contain a Stored Cross-Site Scripting (XSS) vulnerability in the Backend Editor Settings. The Markup Classes fields (used for paragraph styles, inline styles, table styles, etc.) did not sanitize input to valid CSS class name characters. Malicious values were rendered unsanitized in Froala editor dropdown menus, allowing JavaScript execution when any user opened a RichEditor. Exploitation could lead to privilege escalation if a superuser opens any RichEditor during routine content editing, and requires authenticated backend access with editor settings permissions.

October CMS versions prior to 3.7.13 and 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.

Version 3.4.4 of October CMS contains a vulnerability that allows arbitrary file uploads, enabling attackers to execute arbitrary code via a crafted file.