Winter CMS JavaScript Asset LFI Vulnerability and Patch Analysis

Vulnerability Overview Title: Local File Inclusion through directives in JavaScript asset compilation Description: This vulnerability allows authenticated backend users to disclose arbitrary files readable by the PHP process by placing an or directive in a theme's JavaScript assets. Winter CMS's processes / directives within inclusion blocks and inlines them into the combined output without any restriction checks. Consequently, directives such as escape the theme asset tree and read any read-only file. The only restriction is that the target file must have a file extension, as files without a extension are appended to the combined output unchanged. Since the combined output is served via the route, which performs no authentication or authorization checks, the disclosed content becomes readable to unauthenticated visitors as long as the asset is referenced by a template. The leaked content includes any file readable by the web process, primarily application files (disclosing and database credentials). Text files are disclosed as-is, while binary content is mangled by the pipe. This is the same vulnerability as the JavaScript importer counterpart in (Local File Inclusion via LESS directives) and / (the same class of vulnerability via LESS compilation). Affected Versions Affected Versions: Fixed Version: Privilege Requirements: Requires permission (default assigned to the built-in developer role) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: High - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: None - Availability: None Remediation Patch: The now applies two separate gates to each / target: 1. Only targets can be inlined. Any other extension is rejected before path resolution, neutralizing the disclosure of non-JavaScript server files (such as , , and ). Extensions containing dots are unaffected as they are resolved to before this check. 2. The resolved path must reside within the directory subtree of the including file or within the caller-configured allowed import roots, enforced via the new helper method. Rejected includes emit a comment at the location of the file content (or throw an exception if the directive is ). Allowed root configuration is now shared between the JavaScript importer and LESS compiler via the trait and configuration — along with the CSS filter, which uses the importer validator introduced in (with , , and ) as allowed roots. This preserves cross-theme imports, which shape the legitimate use of plugins and modules (e.g., plugin assets importing module assets), while restricting everything else. Backend permission descriptions for and now also carry the warning "Should only be granted to trusted users," mirroring what is already shown for , , and . This security issue has been fixed in (Winter Core) and (Winter Storm). Workaround: If upgrading is not possible, manually apply commits and . As a temporary mitigation, remove the permission from any roles not held by fully trusted administrators or developers, and audit existing theme assets for / directives that resolve outside the theme asset directory. References — The corresponding issue for LESS , sharing the same root cause and hardening approach. (CVE-2023-52085) — Earlier Local File Inclusion via LESS compilation. Thanks to Ziyad Mohamed Elmahy (@elmahy111) for reporting this issue.

Goal Reached Thanks to every supporter — we hit 100%!

Winter CMS JavaScript Asset LFI Vulnerability and Patch Analysis

More from this source