GHSA-78vg-7v27-hj67 — auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped

auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped

The advisory, in context

Summary

Unescaped entity property enables Javascript injection.

Details

I think this is possible because %source_label% in twig macro is not escaped. Therefore script tags can be inserted and are executed.

PoC

clone example project https://github.com/DamienHarper/auditor-bundle-demo
create author with FullName <script>alert()</script>
delete author
view audit of authors
alert is displayed

Impact

persistent XSS. JS can be injected and executed.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

damienharper/auditor-bundle Packagist

Ecosystem versions

Earlier releases before 5.2.6

Fixed in 5.2.6

60 explicitly affected versions

1.0.0, 1.0.1, 1.0.10, 1.0.11, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.0, 1.2.0, 1.2.1, 1.2.2, 1.3.0, 1.4.0, 1.5.0, 1.5.1, 1.6.0, 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.5.0, 3.0.0, 3.1.0, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.3.0, 3.3.1, 3.3.2, 3.4.0, 3.4.1, 3.4.2, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.1.0, 4.2.0, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1.0, 5.1.1, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "5.2.6"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.0.0",
    "1.0.1",
    "1.0.10",
    "1.0.11",
    "1.0.2",
    "1.0.3",
    "1.0.4",
    "1.0.5",
    "1.0.6",
    "1.0.7",
    "1.0.8",
    "1.0.9",
    "1.1.0",
    "1.2.0",
    "1.2.1",
    "1.2.2",
    "1.3.0",
    "1.4.0",
    "1.5.0",
    "1.5.1",
    "1.6.0",
    "2.0.0",
    "2.1.0",
    "2.2.0",
    "2.3.0",
    "2.3.1",
    "2.3.2",
    "2.4.0",
    "2.5.0",
    "3.0.0",
    "3.1.0",
    "3.2.0",
    "3.2.1",
    "3.2.2",
    "3.2.3",
    "3.3.0",
    "3.3.1",
    "3.3.2",
    "3.4.0",
    "3.4.1",
    "3.4.2",
    "4.0.0",
    "4.0.1",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.1.0",
    "4.2.0",
    "5.0.0",
    "5.0.1",
    "5.0.2",
    "5.0.3",
    "5.1.0",
    "5.1.1",
    "5.2.0",
    "5.2.1",
    "5.2.2",
    "5.2.3",
    "5.2.4",
    "5.2.5"
  ]
}

Set up in your agent.

Investigate in your agent.