Request: update GHSA-p78q-v3pr-p87j impact and request a CVE
Hi @giuscris,
I am the original reporter credited on GHSA-p78q-v3pr-p87j. I performed a second impact analysis against Formwork 2.3.12 and validated an end-to-end, persistent editor-to-administrator privilege-escalation chain.
Validated impact
An editor-controlled formaction="javascript:..." payload, after one administrator click:
- executes JavaScript in the Formwork origin;
- fetches
/panel/users/ using the administrator's session;
- extracts the valid panel CSRF token;
- POSTs the real
newUserModal[...] fields to /panel/users/new/;
- persists a new account with
role: admin.
The editor role explicitly has panel.users.create: false, so the new administrator account is created only through the victim administrator's authority.
End-to-end evidence
The chain was executed using a real Chromium click through Selenium. Relevant observed output:
LOGIN_URL=http://127.0.0.1:8765/panel/login/
LOGIN_TITLE=Login | Formwork
DOM_RESULT=HTTP_200_URL_http://127.0.0.1:8765/panel/users/
ADMIN_ACCOUNT_EXISTS=True
username: pocadmin
fullname: 'PoC Admin'
email: pocadmin@example.test
language: en
role: admin
image: null
colorScheme: auto
lastAccess: null
I omitted the local password hash because it is unnecessary to establish impact. The full reproduction notes and Selenium/Markdown PoCs are linked below.
Requested advisory changes
Could you please consider:
- updating the impact description to mention persistent editor-to-administrator privilege escalation;
- reviewing the current Medium/5.4 rating;
- requesting a CVE for the existing repository advisory through GitHub's CNA workflow?
A proposed CVSS v3.1 vector for discussion is:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H (7.9 High)
This proposal does not hide the existing preconditions: pages.content.allowHtml must be enabled, the attacker needs page-editing privileges, and an administrator must click the crafted control. The higher impact is based on the validated persistent administrative account and the resulting administrative capabilities.
Reproduction material
https://gist.github.com/capivara-research/2c9fc01c3167c396bdbb543af03f3dcc
The vulnerable range and patch remain unchanged: 2.0.0 through 2.3.12, fixed in 2.3.13 by #940.
Thank you again for addressing the original report quickly.
Request: update GHSA-p78q-v3pr-p87j impact and request a CVE
Hi @giuscris,
I am the original reporter credited on GHSA-p78q-v3pr-p87j. I performed a second impact analysis against Formwork 2.3.12 and validated an end-to-end, persistent editor-to-administrator privilege-escalation chain.
Validated impact
An editor-controlled
formaction="javascript:..."payload, after one administrator click:/panel/users/using the administrator's session;newUserModal[...]fields to/panel/users/new/;role: admin.The editor role explicitly has
panel.users.create: false, so the new administrator account is created only through the victim administrator's authority.End-to-end evidence
The chain was executed using a real Chromium click through Selenium. Relevant observed output:
I omitted the local password hash because it is unnecessary to establish impact. The full reproduction notes and Selenium/Markdown PoCs are linked below.
Requested advisory changes
Could you please consider:
A proposed CVSS v3.1 vector for discussion is:
This proposal does not hide the existing preconditions:
pages.content.allowHtmlmust be enabled, the attacker needs page-editing privileges, and an administrator must click the crafted control. The higher impact is based on the validated persistent administrative account and the resulting administrative capabilities.Reproduction material
https://gist.github.com/capivara-research/2c9fc01c3167c396bdbb543af03f3dcc
The vulnerable range and patch remain unchanged: 2.0.0 through 2.3.12, fixed in 2.3.13 by #940.
Thank you again for addressing the original report quickly.