Summary
The Umbraco Forms package contains a stored XSS vulnerability in the Title and Description component. Users with access to edit forms can inject arbitrary JavaScript into the BodyText and CaptionTag fields, which are rendered as HTML when the form is displayed. This vulnerability allows the execution of arbitrary JavaScript when the form is rendered.
Product
This vulnerability affects the Umbraco Forms package prior to versions 13.0.1, 12.2.2, 10.5.3 and 8.13.13.
Impact
An attacker with access to edit a form can inject arbitrary JavaScript into the BodyText or CaptionTag fields. When the form is rendered, the JavaScript executes in the browser, potentially allowing attackers to steal sensitive information or manipulate content in the context of the victim.
Steps to reproduce
- Log in as a user with permission to edit a form in Umbraco Forms.
- Inject malicious JavaScript into the
BodyTextorCaptionTagfields of theTitle and Descriptioncomponent. - Render the form to trigger the XSS.
Expected result:
The XSS is triggered, and the malicious JavaScript is executed in the context of the user viewing the form.
Remediation
The issue was fixed by sanitizing HTML content before rendering it, as well as adding an option for the developer to allow unsafe HTML in the form.
The fix was applied in the following versions:
- 13.0.1
- 12.2.2
- 10.5.3
- 8.13.13
Credit
This issue was discovered and reported by Checkmarx Security Researcher Raphael Silva.
