CVE-2024-45612 Insert tag injection via canonical URL in Contao
An untrusted user can inject insert tags into the canonical URL, leading to potential code execution on the front end.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45612?
CVE-2024-45612 is a medium-severity cross-site scripting vulnerability in contao, published on 17 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (front end). Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade should disable canonical tags in the root page settings.
Which versions are affected by CVE-2024-45612?
6 open source packages ship an affected version, including contao/core-bundle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
contao/core-bundle Packagist | From 4.13.0 | 4.13.49 |
contao/core-bundle Packagist | From 4.13.0 | 4.13.49 |
contao/core-bundle Packagist | From 5.0.0 | 5.3.15 |
contao/core-bundle Packagist | From 5.0.0 | 5.3.15 |
contao/core-bundle Packagist | From 5.4.0 | 5.4.3 |
contao/core-bundle Packagist | From 5.4.0 | 5.4.3 |
Products include Contao Contao.
How do I fix CVE-2024-45612?
Upgrade contao/core-bundle to a fixed version for your release line: 4.13.49, 5.3.15 or 5.4.3.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-45612 being exploited?
There is no known exploitation of CVE-2024-45612 in the wild and no public exploit code.
Other vulnerabilities in contao
- CVE-2022-26265 Remote Code Execution in Contao Managed Edition
- CVE-2019-11512 Contao SQL injection in the file manager
- CVE-2012-4383 Contao core SQL Injection Vulnerability
- CVE-2019-19745 Unrestricted file uploads in Contao
- CVE-2024-28235 Contao possible cookie sharing with external domains while checking protected pages for broken links
Sources
Also known as GHSA-2xpq-xp6c-5mgj.