Summary
Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the displayable_links_js function, which fails to properly sanitize blog post titles before including them in JSON responses served via /admin/displayable_links.js. An authenticated admin user can create a blog post with a malicious JavaScript payload in the title field, then trick another admin user into clicking a direct link to the /admin/displayable_links.js endpoint, causing the malicious script to execute in their browser.
Product
This vulnerability affects Mezzanine CMS in versions prior to 6.1.1
Impact
This stored XSS vulnerability allows one authenticated admin user to execute malicious JavaScript code in another admin user’s browser session. The impact includes session hijacking, unauthorized actions, and data exfiltration within the admin interface. While the vulnerability is limited to admin-to-admin attacks, it poses significant risks in environments with multiple administrative privilege levels.
Steps to reproduce
- Log in to the Mezzanine admin interface with administrative privileges
- Navigate to Content → Blog posts
- Create a new blog post with a malicious JavaScript payload in the title field:
<script>alert(document.cookie)</script> - Save the blog post
- Create another blog post and edit its content
- While editing, use the Insert/edit link functionality in the content editor. This action automatically triggers a
GETrequest to/admin/displayable_links.js - Observe that the malicious script executes immediately due to the unsanitized content in the JSON response
- Direct another admin user to click on the link:
http://[your-domain]/admin/displayable_links.js. This can be achieved by creating another blog post and inserting a direct link to the vulnerable endpoint in the content editor.
Remediation
A fix was released in commit 898630d, which includes proper HTML sanitization. Users are recommended to upgrade to version 6.1.1, which includes this fix.
Credit
This issue was discovered and reported by Checkmarx AppSec Analyst Alex Shleymovich.
