Description
Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes when administrators open the record's form.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| zofe | rapyd-admin | 0.4.0, 0.8.5 – ≤ 0.12.17, 1.0.0, 1.1.0 – ≤ 1.1.8, 9.0.0 – < 9.20.0 | 9.20.0 |
References
- Patch Commit patch
- rapyd-admin v9.20.0 Release Notes release-notes
- Vulnerable code in rich-text.blade.php technical-description
- dot_to_property helper in helpers.php technical-description
- https://github.com/zofe/rapyd-admin product
- VulnCheck Advisory: Rapyd Admin before 9.20.0 Stored XSS via rich-text Component third-party-advisory