CVE-2023-6551 Stored XSS in class.upload.php
Stored XSS in class.upload.php allows attackers to inject scripts via uploaded files, requiring developers to implement extension whitelisting and content-type enforcement.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-6551?
CVE-2023-6551 is a medium-severity cross-site scripting vulnerability in class.upload.php, published on 4 Jan 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
As a simple library, class.upload.php does not perform an in-depth check on uploaded files, allowing a stored XSS vulnerability when the default configuration is used.
Developers must be aware of that fact and use extension whitelisting accompanied by forcing the server to always provide content-type based on the file extension.
The README has been updated to include these guidelines.
Weakness: CWE-434
Which versions are affected by CVE-2023-6551?
2 open source packages ship an affected version, including verot/class.upload.php. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
verot/class.upload.php Packagist | All versions to 2.1.6 | None |
verot/class.upload.php Packagist | All versions to 2.1.6 | None |
Products include Verot Class.upload.php.
How do I fix CVE-2023-6551?
No fix has been published for CVE-2023-6551 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-6551 being exploited?
There is no known exploitation of CVE-2023-6551 in the wild and no public exploit code.
Sources
Also known as GHSA-v6f4-jwv9-682w.