Cross-site Scripting (XSS) - Stored in spinacms/spina

Vulnerability

Description

CVE-2023-3445 is a stored cross-site scripting (XSS) vulnerability in Spina CMS, a Ruby on Rails content management system. The root cause is insufficient sanitization of the page title attribute when displayed in the admin interface's delete confirmation dialog. The commit that fixes the issue [4] shows the vulnerability originates in the view where @page.title is directly interpolated into a JavaScript-enabled context without sanitization. Specifically, the confirm_message parameter of the delete button form data was rendering the raw page title, allowing an attacker to inject malicious HTML or JavaScript.

Exploitation

An authenticated user with permission to create or edit pages can exploit this vulnerability. By setting a page title to a malicious payload (e.g., ``), the payload becomes stored in the database. When any administrator (including those with higher privileges) visits the page listing or uses the delete functionality, the unsanitized title is rendered in the confirmation dialog, executing the injected script in the context of the admin's browser session [1]. No additional user interaction beyond viewing the affected page list is required.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an authenticated administrator's session within the Spina admin panel. This could lead to session hijacking, defacement of administrative content, theft of sensitive tokens or cookies, and potentially privilege escalation by performing actions on behalf of the victim administrator. Since the vulnerability is stored, the payload persists and can affect multiple users over time, increasing its severity.

Mitigation

The vulnerability was addressed in Spina version 2.15.1 by sanitizing the page title using Rails' sanitize helper before passing it to the confirmation dialog [1][4]. Users are strongly advised to upgrade to version 2.15.1 or later. No workarounds are publicly documented; patching is the recommended course of action. The fix was released on June 28, 2023, and the vulnerability has been publicly disclosed [1][2].