CVE-2024-54123 in Backdrop
Summary
by MITRE • 11/29/2024
Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/07/2026
Backdrop CMS versions prior to 1.28.4 and 1.29.x prior to 1.29.2 contain a cross-site scripting vulnerability that occurs when SVG documents are processed through text formats that permit SVG tags. This vulnerability arises from insufficient input validation and sanitization of SVG content, allowing malicious actors to inject malicious scripts within SVG elements. The flaw specifically manifests when administrators configure text formats to allow SVG tags, creating an attack surface where user-supplied SVG content can contain embedded malicious code.
The technical implementation of this vulnerability stems from the CMS's failure to properly sanitize SVG content before rendering it in web pages. When SVG tags are permitted in text formats, the system does not adequately filter or escape potentially dangerous attributes and elements within the SVG structure. This allows attackers to embed script tags, event handlers, or other malicious code within SVG documents that are then executed in the context of other users' browsers. The vulnerability is categorized under CWE-79 as Cross-Site Scripting, with specific implications for content management systems that handle rich text input. Attackers can leverage this weakness to execute arbitrary JavaScript code in victim browsers, potentially leading to session hijacking, data theft, or further exploitation of the compromised systems.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable attackers to perform actions such as stealing user credentials, manipulating content, or redirecting users to malicious websites. When combined with other vulnerabilities or attack vectors, this XSS flaw can serve as a stepping stone for more sophisticated attacks within the CMS environment. The vulnerability affects any Backdrop CMS installation where administrators have configured text formats to allow SVG content, making it particularly concerning for sites that accept user-generated content or allow content editors to submit rich media. This weakness directly relates to ATT&CK technique T1566.001 for credential access through phishing, as attackers can craft malicious SVG documents that trick users into executing code.
Organizations using affected Backdrop CMS versions should immediately upgrade to the patched releases 1.28.4 and 1.29.2 to remediate this vulnerability. Administrators should also review their text format configurations to ensure that SVG tags are only permitted in contexts where SVG content is properly validated and sanitized. The recommended mitigation strategy involves implementing strict input validation for all SVG content, applying proper HTML escaping to prevent script execution, and regularly auditing text format permissions. Additionally, organizations should consider implementing content security policies that restrict script execution within SVG contexts, and establish monitoring procedures to detect suspicious SVG content submissions. This vulnerability highlights the importance of proper input sanitization in web applications and demonstrates how seemingly benign features like SVG support can introduce significant security risks when not properly implemented.