Slim has Reflected XSS in the HtmlErrorRenderer
The advisory, in context
Impact
If an application uses HttpException::setTitle() and/or setDescription() to include untrusted/request-derived data in the error title or description (e.g. "No products found matching '{$query}'."), an attacker could inject arbitrary HTML/JavaScript that executes in the victim's browser when they encounter an HTML error page generated by Slim.
The vulnerability is present even with displayErrorDetails = false as the unescaped title and description are rendered on this error path.
Built-in exceptions (HttpNotFoundException, HttpBadRequestException, etc.) ship plain-text defaults, so a vanilla Slim app with no user code is not exploitable. Only applications that feed untrusted data into setTitle() and/or setDescription() are affected.
Patches
The issue is fixed in 4.15.2.
Workarounds
Without upgrading, applications can:
- Avoid passing untrusted/request-derived data into
HttpException::setTitle()andsetDescription(). Use static, plain-text error copy instead. - Register a custom error renderer (an
ErrorRendererInterfaceimplementation, or a subclass ofHtmlErrorRendererthat escapes the title and description) for the HTML media type.
Acknowledgments
Slim is grateful to and thanks GitHub user 0xEr3n for reporting this issue.
Resources
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 4.4.0 before 4.15.2
Fixed in 4.15.2
15 explicitly affected versions
4.10.0, 4.11.0, 4.12.0, 4.13.0, 4.14.0, 4.15.0, 4.15.1, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.7.1, 4.8.0, 4.8.1, 4.9.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.4.0"
},
{
"fixed": "4.15.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.10.0",
"4.11.0",
"4.12.0",
"4.13.0",
"4.14.0",
"4.15.0",
"4.15.1",
"4.4.0",
"4.5.0",
"4.6.0",
"4.7.0",
"4.7.1",
"4.8.0",
"4.8.1",
"4.9.0"
]
}