Description

REDAXO has reflected XSS in backend Metainfo API via type parameter (CSRF token required)

Summary

A reflected XSS vulnerability has been identified in the REDAXO backend. The type parameter is concatenated into an API error message and rendered without HTML escaping.

Details

Root cause
User input type is injected into an exception message, then rendered by rex_view::error() which delegates to rex_view::message() without HTML escaping.

Vulnerable code (redaxo/src/addons/metainfo/lib/handler/api_default_fields.php) :

$type = rex_get('type', 'string');
throw new rex_api_exception(sprintf('metainfo type "%s" does not have default field.', $type));

Sink (redaxo/src/core/lib/view.php) :

return '<div class="' . $cssClassMessage . '">' . $message . '</div>';

Data flow source -> sink

Source : type (GET)

Propagation : concatenated into the exception message

Sink : rendered via rex_view::error() -> rex_view::message() without escaping

Authentication required : yes (backend session)

PoC - exploit

#!/usr/bin/env python3
import re
import urllib.parse
import requests

TARGET_URL = "http://poc.local/"
BACKEND_PATH = "redaxo/index.php"
SESSION_ID = "xxxxxxxxxxxxxxxxxxxxx"...
Show more

The script uses only the provided PHPSESSID, retrieves the CSRF token from the metainfo page, and prints a ready-to-use exploit link.

Impact

Confidentiality : Low : no direct session theft (HttpOnly cookies), but possibility to access/exfiltrate data available via the DOM or via same-origin requests if the XSS executes in a victim’s session.

Integrity : Low : possibility to chain backend actions on behalf of the user (same-origin requests) only if execution takes place in a victim session; otherwise the impact is limited to the user who triggers the call.

Availability : Low : the XSS could disrupt the administration interface or trigger unwanted actions, but the token requirement strongly limits realistic scenarios.

Video

https://github.com/user-attachments/assets/251f548c-3f68-483b-a012-b8fc28493a83

Mitigation

Aliases

References