MODX Revolution up to 2.2.14 context_key cross site scripting

Summaryinfo

A vulnerability was found in MODX Revolution. It has been declared as problematic. Affected is an unknown function. Executing a manipulation of the argument context_key can lead to cross site scripting. This vulnerability is tracked as CVE-2014-8774. The attack can be launched remotely. Moreover, an exploit is present. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in MODX Revolution (Content Management System). This vulnerability affects some unknown processing. The manipulation of the argument context_key with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

Cross-site scripting (XSS) vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attackers to inject arbitrary web script or HTML via the context_key parameter.

The weakness was disclosed 12/03/2014 (Website). The advisory is shared for download at hacktivity.websecgeeks.com. This vulnerability was named CVE-2014-8774 since 11/13/2014. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. Technical details and also a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1059.007.

It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept.

Upgrading to version 2.1.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (35159). The entries VDB-73073 and VDB-73071 are pretty similar. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Content Management System

Vendor

• MODX

Name

• Revolution

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.1.0
• 2.1.1
• 2.1.2
• 2.1.3
• 2.1.4
• 2.1.5
• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.7
• 2.2.8
• 2.2.9
• 2.2.10
• 2.2.11
• 2.2.12
• 2.2.13
• 2.2.14

License

• open-source

Website

• Vendor: https://modx.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion