Summary

XSS can be triggered via the Update Asset Index utility

PoC

1. Access setting tab
2. Create new assets
3. In assets name inject payload: "<script>alert(26)</script>
4. Click Utilities tab
5. Choose all volumes, or volume trigger xss
6. Click Update asset indexes.

XSS will be triggered

Json response volumes name makes triggers the payload

"session":{"id":1,"indexedVolumes":{"1":"\"<script>alert(26)</script>"},

It’s run on every POST request in the utility.

Resolved in craftcms/cms@8c2ad0b

References

• GHSA-6qjx-787v-6pxr
• craftcms/cms@8c2ad0b
• https://github.com/craftcms/cms/releases/tag/4.4.6
• https://nvd.nist.gov/vuln/detail/CVE-2023-33197