CVE-2021-35210

Vulnerability

Contao CMS versions 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, contain a stored cross-site scripting (XSS) vulnerability in the tl_log table [1]. An attacker can inject arbitrary JavaScript code into log entries that are stored in this table. When an administrator accesses the system log in the back end, the injected code is executed in the browser [1].

Exploitation

An attacker must be able to write entries to the tl_log table. This could be achieved through other vulnerabilities (e.g., SQL injection) or by having direct database write access. No user interaction beyond the administrator viewing the system log is required for the XSS to trigger [1]. The injected code is stored persistently and executed each time the log is loaded.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the authenticated administrator's browser session. This can lead to session hijacking, theft of sensitive data, defacement of the back end interface, or further compromise of the Contao installation [1].

Mitigation

Upgrade to Contao version 4.9.16 or 4.11.5 (or any later release) to remediate the vulnerability [1][3][4]. No workaround is documented. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.