Kirby Cross-Site Scripting Vulnerability via Untrusted Links in KirbyTags and Image Blocks

A cross-site scripting (XSS) vulnerability has been identified in Kirby, an open-source content management system, affecting versions prior to 4.9.1 and 5.4.1. The issue arises in the KirbyTags and image blocks components, where the URL methods failed to filter out malicious URLs that could be executed as scripts. This vulnerability impacts four first-party Kirby renderers that create links from user-supplied content: the 'link' KirbyTag, the 'link' parameter of the 'image' KirbyTag (when it doesn't point to a known file or 'self'), the 'link' field in the built-in image block, and the HTML importer for blocks. The vulnerability is triggered when content is authored by users who may not be fully trusted, allowing for the injection of harmful scripts that could be executed in the site frontend or through a compromised Panel session.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected JavaScript is executed in the context of the user viewing the site, potentially leading to unauthorized actions within their Panel session.

Remediation

Users can update to Kirby versions 4.9.1 or 5.4.1 to address this vulnerability. In these releases, the URL handling methods have been improved to detect and neutralize dangerous schemes, preventing them from being executed as scripts when links are clicked.