GHSA-7mpf-4465-7fc2: Stored Cross-Site Scripting in Winter CMS Backend List Widget

The vulnerability designated as GHSA-7mpf-4465-7fc2 describes a Stored Cross-Site Scripting (XSS) flaw in the backend modules of Winter CMS, specifically affecting the winter/wn-backend-module package.

This vulnerability is rooted in the List widget (Backend\Widgets\Lists), which is responsible for rendering administrative records in a tabular format. The system allows developers to specify various column types, including text, number, and image.

While the core installation of Winter CMS does not configure any list columns to use the image type by default, third-party plugins and custom modules frequently employ this feature. When a list column is configured as an image type, it renders dynamic database content into the final HTML output. If this content is influenced by a malicious actor, it introduces an input vector for client-side injection attacks.

The technical origin of the flaw lies in how the evalImageTypeValue method within the Backend\Widgets\Lists class interpolates URL strings.

The application constructs the source HTML element by concatenating the image URL directly into single quotes within the src attribute. This variable interpolation is executed without any escaping context, making it vulnerable to attribute breakout.

The vulnerability is compounded by the behavior of ImageResizer::filterGetUrl(). When this helper function receives an external or unresolvable URL string, it returns the input value verbatim as a fallback. Consequently, any string submitted by an attacker is passed directly to the HTML template generation routine.

Furthermore, developers frequently assume standard URL validation is sufficient to prevent payload injection. However, standard validation routines like PHP's native FILTER_VALIDATE_URL do not strip quotes or forward slashes. An attacker can construct a payload that satisfies standard URL formatting constraints while retaining the syntax required to break out of single quotes when parsed by modern web browsers.

To understand the exact mechanics, we must examine the difference between the vulnerable code path and the implemented security patch in the file modules/backend/widgets/Lists.php.

Prior to the patch, the evalImageTypeValue function executed string interpolation directly without context-aware encoding:

if ($image) {
    $imageUrl = ImageResizer::filterGetUrl($image, $width, $height, $options);
    return "<img src='$imageUrl' width='$width' height='$height' />";
}

Because the $imageUrl value is wrapped in single quotes, an attacker who injects a single quote followed by an event handler can rewrite the DOM element's structure. The patch introduced by the Winter CMS core team addresses this by using the e() helper function, which translates to htmlspecialchars with ENT_QUOTES configured:

if ($image) {
    // filterGetUrl() returns the value it was given when the image cannot be
    // resolved, so the result may still be the record's raw value.
    $imageUrl = ImageResizer::filterGetUrl($image, $width, $height, $options);
 
    return sprintf(
        "<img src='%s' width='%s' height='%s' />",
        e($imageUrl),
        e($width),
        e($height)
    );
}

This remediation ensures that single quotes, double quotes, and other special HTML characters are systematically converted to their corresponding safe HTML entities. Consequently, any injected quotes are rendered as plain text within the attribute boundary rather than being interpreted by the browser parser as an attribute delimiter.

An attacker seeking to exploit this vulnerability must identify a model field mapped to an image list column that accepts external input.

A typical proof-of-concept payload targets the src attribute boundary using single quotes and the forward slash character:

http://example.com/a.jpg'/onerror='window.pwned=1

When processed by the unpatched system, this payload results in the following malformed HTML element being generated:

<img src='http://example.com/a.jpg'/onerror='window.pwned=1' width='100' height='100' />

During DOM parsing, the browser encounters the single quote after a.jpg, which terminates the src attribute. The forward slash acts as a structural separator, and the browser registers onerror as a new event handler attribute. Because the image URL points to a non-existent asset, the browser fires the error event, immediately executing the JavaScript payload within the security context of the active user session.

The overall impact of this stored XSS vulnerability is governed by the access level of the administrative users viewing the affected list view.

While the CVSS 3.1 base score is 2.0 (Low), the concrete consequences in a production environment can be significant if an administrator session is hijacked. Since the payload executes within the backend administrator interface, an attacker could potentially perform administrative operations, alter configuration settings, or exfiltrate sensitive backend data.

The vector requirements demand high privileges (PR:H) to write the malicious payload into the database, or an application structure that exposes writing capabilities to low-privilege or unauthenticated users. The attack complexity is high (AC:H) because it requires specific backend plugin configurations that are not present in a default out-of-the-box installation of Winter CMS.

Due to these constraints, the vulnerability has not been observed in active exploitation campaigns, and no weaponized public exploits are known to exist.

The recommended action to eliminate this vulnerability is upgrading the winter/wn-backend-module package to version 1.2.14 or later.

For systems where an immediate upgrade is not possible, security administrators can manually patch the file modules/backend/widgets/Lists.php using the e() helper as demonstrated in the patch analysis section. This mitigation must be applied across all active environments to prevent exploitation attempts.

Additionally, input validation routines should be reinforced. Although URL validation alone is insufficient to prevent XSS breakout, applying strict sanitization to stored values that are rendered within administrative widgets is a crucial layer of defense.

Security teams can audit existing databases for anomalies by executing queries targeting single quotes within columns used by backend image lists. This proactive measure helps identify historical payloads or potential injection attempts.