CVE-2018-16629

Vulnerability

Subrion CMS v4.2.1 [1] suffers from a stored cross-site scripting (XSS) vulnerability in the panel/uploads/#elf_l1_XA endpoint [4]. An authenticated administrator can upload an SVG file containing a ` element with arbitrary JavaScript [4]. When the SVG file is accessed directly (not embedded via ` tag), the script executes in the context of the admin panel [4].

Exploitation

To exploit this vulnerability, an attacker must have admin-level access to the Subrion CMS [4]. The attacker uploads a crafted SVG file through the file upload functionality in the panel [4]. Once uploaded, any user opening the file (e.g., by clicking on it) triggers the embedded JavaScript [4]. No additional user interaction is required beyond opening the file.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the admin panel domain [4]. This can lead to session hijacking, theft of admin credentials, or further compromise of the CMS, potentially enabling full site takeover [1][4].

Mitigation

The vulnerability has been fixed in Subrion CMS commit fbc29ddb29e9c9732695e25ad2c22e038eed6385 [2]. Users should upgrade to a version containing this fix (likely after 4.2.1) or apply the patch manually [2]. No workaround has been disclosed for unpatched installations.