CamaleonCms v2.9.2 Security Patch: RCE, SSRF, XSS, SQLi Fixes

Vulnerability Overview This version (2.9.2) fixes several critical security vulnerabilities, including: 1. Broken Access Control (CWE-862): Fixed access control issues in . 2. Plugin Admin Authorization: Fixed plugin admin authorization issues in . 3. select_eval Custom Field Type: Restricted the usage permissions of the custom field type. 4. Brakeman Vulnerabilities: Fixed multiple vulnerabilities detected by Brakeman, including dangerous , path traversal, and SQL injection. 5. Mass Assignment Vulnerabilities: Fixed mass assignment vulnerabilities in controllers such as , , , and . 6. Open Redirect Vulnerability: Fixed an open redirect vulnerability in the session helper. 7. Reflected XSS Vulnerability: Fixed a reflected XSS vulnerability in flash messages. 8. Stored XSS (CWE-79): Fixed a stored XSS vulnerability in the content helper. 9. IDOR (CWE-639): Fixed an IDOR (Insecure Direct Object Reference) vulnerability in . 10. SSTI (Server-Side Template Injection): Fixed an SSTI vulnerability in the endpoint. 11. SQL Injection: Fixed a SQL injection vulnerability in . 12. Stored XSS in Post Title Rendering: Fixed a stored XSS vulnerability in post title rendering. 13. Mass Assignment in User Registration: Fixed mass assignment vulnerabilities in user registration. 14. Broken Access Control: Fixed broken access control issues. 15. SSRF Vulnerability: Fixed an SSRF (Server-Side Request Forgery) vulnerability in media URL uploads. 16. RCE in Custom-Field i18n Rendering: Fixed a Remote Code Execution (RCE) vulnerability in custom-field i18n rendering. 17. Path Traversal: Fixed a path traversal vulnerability in . Impact Scope MediaController: All endpoints requiring permission. PluginsAdminController: All plugin admin routes. select_eval Custom Field Type: All instances using custom fields. Categories, Widgets, Posts, Users, and other controllers: All operations involving these controllers. Session Helper: All places using the session helper. Flash Messages: All places displaying flash messages. Content Helper: All places using the content helper. CategoriesController: All operations involving Categories. Test Email Endpoint: All places sending test emails. PostinValidator: All places validating post slugs. Post Title Rendering: All places displaying post titles. User Registration: All user registration processes. Media URL Upload: All media URL upload operations. Custom-Field i18n Rendering: All places using custom-field i18n rendering. CamaleonCmsAssetLoader: All places using . Remediation 1. MediaController: - Added consistent authorization checks to all endpoints requiring permission. - All endpoints are now protected via centralized . 2. PluginsAdminController: - All plugin admin routes now require permission. - Third-party plugins (e.g., , ) are automatically protected when inheriting from . 3. select_eval Custom Field Type: - Restricted the usage permissions of the custom field type; only authorized users can use it. - Added the permission to the user roles UI. - Implemented (ActiveSupport::CurrentAttributes) to provide thread-safe, request-scoped access to and . - Added authorization checks in and callbacks. 4. Brakeman Vulnerabilities: - Fixed dangerous , path traversal, and SQL injection issues. 5. Mass Assignment Vulnerabilities: - Replaced with , allowing only and . - Redirect to instead of to prevent open redirects. 6. Open Redirect Vulnerability: - Fixed the open redirect vulnerability in the session helper. 7. Reflected XSS Vulnerability: - Fixed the reflected XSS vulnerability in flash messages. 8. Stored XSS (CWE-79): - Replaced with to prevent XSS. 9. IDOR (CWE-639): - Modified to limit lookups to the authorized instead of performing global lookups. 10. SSTI (Server-Side Template Injection): - Replaced with to prevent ERB evaluation of exception messages. 11. SQL Injection: - Replaced string interpolation with parameterized queries for slug validation. 12. Stored XSS in Post Title Rendering: - Added HTML escaping when displaying post titles in admin views. 13. Mass Assignment in User Registration: - Replaced with an explicit whitelist to allow parameters in . - Removed from user registration to prevent arbitrary meta injection. 14. Broken Access Control: - Added authorization checks to fix broken access control issues. 15. SSRF Vulnerability: - Fixed the SSRF vulnerability in media URL uploads. 16. RCE in Custom-Field i18n Rendering: - Fixed the Remote Code Execution vulnerability in custom-field i18n rendering. 17. Path Traversal: - Fixed the path traversal vulnerability in . POC Code or Exploit Code No specific POC code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

CamaleonCms v2.9.2 Security Patch: RCE, SSRF, XSS, SQLi Fixes

More from this source