Summary
Freeform for Craft CMS contained a stored cross-site scripting issue in some control panel views. An authenticated Craft CP user with permission to create or edit Freeform forms or integrations could save HTML/JavaScript in certain labels or integration metadata. The payload could execute when another CP user viewed the affected Freeform builder or integration screens.
This issue affects control panel users only. It does not allow unauthenticated front-end visitors to inject JavaScript.
Details
Certain user-controlled values, including form field labels, section labels, and integration metadata, were rendered in Freeform’s React-based control panel UI using raw HTML rendering without sufficient sanitization.
Affected areas included parts of the form builder and integrations UI where saved values were displayed back to CP users.
Proof of Concept
Label-based XSS
- Log in to the Craft control panel as a user with permission to create or edit Freeform forms.
- In Craft CP, create/edit a Freeform field and set its label to
<img src=x onerror="alert('xss-label')">.
- Open the form builder view containing the field.
- Alert executes (stored XSS).
Integration icon SVG
- Log in to the Craft control panel as a user with permission to create or edit Freeform forms.
- Set an integration "icon SVG" to
<svg><script>alert('xss-icon')</script></svg>.
- Open the integrations CP view.
- Script executes.
Impact
A malicious authenticated CP user with Freeform form or integration editing permissions could execute JavaScript in another CP user’s browser when that user viewed the affected Freeform screens.
Depending on the victim’s permissions and browser/session protections, the injected script could perform actions in the Craft CP as the victim or access data available to that user.
Remediation
Update to Freeform 5.14.7 or later.
The issue was resolved by escaping or sanitizing user-controlled values before rendering them in the Freeform control panel UI and by avoiding raw HTML rendering where it was not required.
Workarounds
Restrict Freeform form and integration editing permissions to trusted users until the plugin can be updated.
Credits
Discovered by Prav33N-Sec
Pr4v33N-Sec Reporter
Summary
Freeform for Craft CMS contained a stored cross-site scripting issue in some control panel views. An authenticated Craft CP user with permission to create or edit Freeform forms or integrations could save HTML/JavaScript in certain labels or integration metadata. The payload could execute when another CP user viewed the affected Freeform builder or integration screens.
This issue affects control panel users only. It does not allow unauthenticated front-end visitors to inject JavaScript.
Details
Certain user-controlled values, including form field labels, section labels, and integration metadata, were rendered in Freeform’s React-based control panel UI using raw HTML rendering without sufficient sanitization.
Affected areas included parts of the form builder and integrations UI where saved values were displayed back to CP users.
Proof of Concept
Label-based XSS
<img src=x onerror="alert('xss-label')">.Integration icon SVG
<svg><script>alert('xss-icon')</script></svg>.Impact
A malicious authenticated CP user with Freeform form or integration editing permissions could execute JavaScript in another CP user’s browser when that user viewed the affected Freeform screens.
Depending on the victim’s permissions and browser/session protections, the injected script could perform actions in the Craft CP as the victim or access data available to that user.
Remediation
Update to Freeform 5.14.7 or later.
The issue was resolved by escaping or sanitizing user-controlled values before rendering them in the Freeform control panel UI and by avoiding raw HTML rendering where it was not required.
Workarounds
Restrict Freeform form and integration editing permissions to trusted users until the plugin can be updated.
Credits
Discovered by Prav33N-Sec