CVE-2017-1000431

Vulnerability

An XSS vulnerability exists in the eZ Systems eZ Publish search module, affecting versions 5.4.0 to 5.4.9, and 5.3.12 and older. The issue arises from insufficient input sanitization in parameters such as SearchPageLimit, SectionID, SearchTimestamp, and SubTreeArray in the backoffice content search functionality [1][2][3]. The fix [4] shows that the application was passing unsanitized HTTP variables to the output, allowing arbitrary HTML or JavaScript injection.

Exploitation

An attacker with network access to the eZ Publish installation and the ability to craft malicious requests can inject scripts. No authentication is explicitly required for the search module, but exploitation likely depends on the user interaction; if a privileged user visits a crafted URL containing the malicious payload, the script executes in their browser context. The attacker would craft a URL with embedded JavaScript in vulnerable parameters such as SearchPageLimit or SectionID and trick a victim into clicking it [2][3].

Impact

Successful exploitation leads to cross-site scripting (XSS), which allows the attacker to execute arbitrary JavaScript in the victim's browser. This can result in theft of session cookies, credentials, or other sensitive data, and potentially perform actions on behalf of the victim, compromising confidentiality and integrity of the application and its data [1][2].

Mitigation

The fix was applied in commit c7174295fa0b9bd81bd4af908082464b0b80f278 [4]. Upgrading to a patched version, such as eZ Publish 5.4.10 or later (or applying the commit), mitigates the issue. As of the publication date, no workaround is documented beyond applying the patch. The official advisory (EZSA-2017-005) recommends updating to the fixed version [2].