Insert tag injection via canonical URL in Contao

Vulnerability

Overview Contao CMS versions prior to 4.13.49, 5.3.15, and 5.4.3 are vulnerable to an insert tag injection through the canonical tag. The headBag::getCanonicalUriForRequest method returns a URL that is used in the HTML ` tag without sanitizing insert tags. An untrusted user can inject insert tags (e.g., {{some_tag}}`) into the canonical URL, which are then processed and replaced by Contao's insert tag engine on the front end [1].

Exploitation

An attacker with the ability to influence the canonical URL (e.g., by manipulating request parameters or via other injection points) can inject arbitrary insert tags. The vulnerability requires no authentication and has low attack complexity, as described in the associated GitHub Security Advisory [3]. The injection occurs during page rendering, and the attacker's payload is evaluated server-side.

Impact

Successful exploitation allows an attacker to execute arbitrary insert tags, which can lead to content injection, data leakage, or other unintended behaviors depending on the available insert tag functionality. The severity is compounded by the fact that insert tags in Contao can perform sensitive operations such as including templates or fetching data [3].

Mitigation

Users are advised to update to Contao 4.13.49, 5.3.15, or 5.4.3, which include a fix that escapes braces ({, }) in the canonical URL to prevent insert tag processing [4]. If upgrading is not immediately possible, disabling canonical tags in the root page settings provides a workaround [1].