CVE-2021-29460

Executive Summary

CVE-2021-29460 is a stored Cross-Site Scripting (XSS) vulnerability in Kirby CMS affecting versions prior to 3.5.4. An authenticated editor with write access to the Kirby Panel can upload an SVG file containing malicious JavaScript that executes when a victim opens the direct file link in a browser where they are logged into the CMS. The vulnerability is critical in collaborative environments where untrusted editors exist, as it enables privilege escalation to admin-level access through session theft, and can also affect frontend users if SVG uploads are permitted in public forms.

The flaw has been patched in Kirby 3.5.4, with no public exploit code or CISA KEV listing confirmed at this time. CVSS 3.1 score of 7.6 (High) reflects the network-based attack vector, low attack complexity, and potential for significant confidentiality and integrity impact.

Technical Analysis

Kirby is an open-source flat-file CMS that allows authenticated Panel users to manage content, including file uploads via the media library and file blueprints. The vulnerability exists in the file upload handling pipeline, where SVG images are accepted without sanitization of embedded executable content.

Vulnerability Class and Mechanism:

SVG (Scalable Vector Graphics) files are XML-based documents that support embedded scripting via <script> tags and event handler attributes (e.g., onload, onclick). When a browser renders an SVG file directly — either by navigating to the file URL or embedding it in an HTML context — any JavaScript contained within the SVG executes in the context of the originating domain.

The core flaw is that Kirby 3.5.3 and earlier versions did not strip or neutralize script content from uploaded SVG files. This is a classic CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) failure, specifically the "inappropriate source" pattern where user-controlled file content is served back to clients without sanitization.

Attack Surface:

The attack surface consists of two distinct vectors:

1. Authenticated Panel Vector (Primary): An authenticated user with write access to the Panel (e.g., an editor role) uploads a malicious SVG file. The direct URL to that file (/media/... or similar path) is shared with a victim who is logged into the Kirby Panel. When the victim opens the link, the script executes within their browser session, with the victim's permissions.

2. Frontend Form Vector (Secondary): If the site allows file uploads via public-facing forms (e.g., user profile submission, contact forms, blog submissions) AND the uploaded files are stored without sanitization, then unauthenticated visitors can be impacted. However, the NVD description notes that this vector requires the site to permit SVG uploads in frontend forms without sanitization.

Technical Chain:

1. The attacker crafts an SVG file containing malicious JavaScript, e.g., embedded within a <script> tag or within an onload event attribute.
2. The file is uploaded through the Panel's file upload mechanism.
3. Kirby stores the file as-is, without validating or stripping the script content.
4. The attacker obtains the direct URL to the uploaded file (visible in the Panel's file browser or by inspecting the media directory).
5. The attacker delivers this link to a victim (phishing email, CMS comment, or chat).
6. When the victim is authenticated to Kirby and opens the link, the browser executes the JavaScript.
7. The malicious script can issue authenticated API requests (e.g., to create an admin user, modify content, or exfiltrate session tokens) — with the victim's session permissions.

Insufficient Technical Detail: The NVD description does not specify the exact file storage path, upload handler function names, or API endpoint structures. Without vendor patch diffs or additional research, we cannot enumerate specific affected endpoints. The description only explicitly mentions File::create() as a protected upload path in patched versions.

Exploitation Scenarios

Note: No public PoC is available; the attack chain below is inferred strictly from the NVD description and the vulnerability class (stored XSS via SVG).

Scenario 1: Privilege Escalation to Admin (Primary Vector)

1. Target Identification: The attacker identifies a Kirby CMS instance running version < 3.5.4. They gain authenticated access with editor-level privileges (either legitimately as a collaborator, or through a prior credential compromise).

2. Trigger: The attacker navigates to the Panel's file upload interface and uploads an SVG file containing embedded malicious JavaScript. For example, the SVG might contain:

   • A <script> tag that executes JavaScript
   • An onload event handler on the root <svg> element

3. Payload Execution: The attacker obtains the direct URL to the uploaded SVG file (the file is served statically from the server without Content-Disposition: attachment headers or X-Content-Type-Options: nosniff protection). The attacker sends this link to an admin user via email, the CMS's message system, or a third-party channel.

4. Post-Exploitation Impact: When the admin clicks the link while logged into Kirby, the JavaScript executes in their browser session. The script can:

   • Issue authenticated requests to Kirby's API to create a new admin user account
   • Modify existing content or site configuration
   • Exfiltrate the admin's session cookie (if HttpOnly flag is absent) or perform CSRF-based actions
   • Install a persistent backdoor via PHP file upload (if the API permits file management operations)

Scenario 2: Site Defacement / Data Theft

1. Trigger: An editor uploads a malicious SVG file that performs fetch() requests to external attacker-controlled servers, exfiltrating page content, user data, or CSRF tokens.

2. Payload Execution: Any visitor (authenticated or not) who navigates directly to the SVG file URL triggers the script. If the site serves the SVG in an inline context (<img> tags or CSS backgrounds), the script may not execute due to browser protections, but direct navigation to the SVG URL will execute scripts.

3. Impact: The attacker harvests session tokens for any authenticated users who visit the link, potentially gaining access to multiple accounts.

Scenario 3: Public Form Upload Abuse

1. Target Identification: An attacker identifies a Kirby site that has a public upload form (contact form, support ticket system, or user-generated content submission) that accepts SVG files without sanitization.

2. Trigger/Execution: The attacker submits a malicious SVG file through the public form. Any subsequent visitor who opens the file link is affected.

3. Impact: If the site has no authenticated areas, the impact is limited to defacement (displaying fake login forms or phishing overlays) or cryptocurrency miners running in the victim's browser. If the site has user accounts, session tokens can be stolen.

Impact Assessment

CVSS Analysis: The CVSS 3.1 score of 7.6 (High) is consistent with this vulnerability class. The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low-privilege authenticated access (PR:L) and user interaction (UI:R). The scope is changed (S:C) because the impact extends beyond the vulnerable component to the victim's browser session. Confidentiality and integrity impacts are both High (C:H/I:H), while availability impact is None (A:N).

Business Impact:

• Data Breach Risk: Successful exploitation of an admin session can expose all CMS-managed content, user databases, configuration files, and potentially the underlying server filesystem if the CMS has file management capabilities.
• Privilege Escalation: The most severe scenario is creating an attacker-controlled admin account, granting persistent access to the CMS.
• Reputational Damage: A defaced site or served malicious content can damage customer trust and lead to regulatory penalties (GDPR/CCPA) if user data is exposed.
• Supply Chain Risk: If the compromised site is part of a marketing or content-distribution chain, attackers can inject malicious content that is served to downstream visitors.

Affected Systems: All Kirby CMS installations running versions earlier than 3.5.4 that allow SVG file uploads. This includes sites using default file blueprints that permit SVG uploads, and sites with custom frontend upload forms.

Blast Radius: The attack requires some form of authenticated access (editor privileges) or open frontend upload forms. The blast radius is therefore limited to sites with multiple user roles or public upload functionality — single-admin sites where all users are fully trusted are at lower risk. However, the availability of legitimate editor credentials (e.g., through prior phishing) significantly expands the attack surface.

Exploitation in the Wild: No public PoC, exploit code, or active exploitation campaigns have been identified in the provided data. The CISA KEV list does not include this CVE, and no Nuclei templates or exploit-code repositories are known. EPSS score of 0.03174 (86.8th percentile) suggests moderate exploit probability — meaning it is more likely to be exploited than most known CVEs, even though exploitation data is not confirmed.

Detection Guidance

Sigma Rule

Sigma detection rule for detecting the upload of SVG files containing script tags (generic XSS detection pattern):

title: Suspicious SVG File Upload with Embedded Script Tags (CVE-2021-29460)
id: 8f8a54ba-5c91-4f32-9f5c-2a3d44cacd21
status: experimental
description: Detects uploads of SVG files containing script tags or event handler attributes, which may indicate an attempt to exploit stored XSS in Kirby CMS or similar web applications.
author: Valtersit Threat Intelligence Team
date: 2024/06/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-29460
tags:
    - attack.initial-access
    - attack.t1190        # Exploit Public-Facing Application
    - attack.t1204.001    # User Execution: Malicious Link
falsepositives:
    - Legitimate SVG graphics files used in web design (rarely include scripts)
    - Test environments
level: medium
logsource:
    category: webserver
    product: generic
    definition: Apache/Nginx access logs for upload endpoints
detection:
    selection_upload_path:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/media/upload'
            - '/panel/upload'
            - '/file'
    selection_sp_content_type:
        cs-content-type: 'image/svg+xml'
        sc-status: 200
    condition: selection_upload_path and selection_sp_content_type

YARA Rule

YARA rule to detect malicious SVG files by inspecting their content for embedded script tags:

rule Kirby_CVE_2021_29460_SVG_XSS {
    meta:
        author = "Valtersit Threat Intelligence Team"
        description = "Detects SVG files containing script tags or javascript event handlers, indicative of stored XSS exploitation (CVE-2021-29460)"
        cve = "CVE-2021-29460"
        date = "2024-06-01"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2021-29460"
    strings:
        $svg_magic = "<svg"
        $script_tag = "<script" nocase
        $script_close = "</script" nocase
        $onload = "onload=" nocase
        $onerror = "onerror=" nocase
        $onclick = "onclick=" nocase
        $javascript_protocol = "javascript:" nocase
        $fetch_call = "fetch(" ascii nocase
        $xmlhttp = "XMLHttpRequest" ascii nocase
    condition:
        $svg_magic at 0 and (
            any of ($script_tag*) or
            any of ($onload, $onerror, $onclick) or
            $javascript_protocol or
            $fetch_call or
            $xmlhttp
        )
}

Suricata IDS Rule

Suricata rule to detect SVG upload responses containing script content:

alert http any any -> $HOME_NET any (msg:"Potential Kirby SVG XSS Upload (CVE-2021-29460)"; flow:to_server; http.method; content:"POST"; http.uri; content:"media"; http.request_body; content:"image/svg+xml"; http.request_body; pcre:"/<script|onload=|onerror=|javascript:/i"; reference:cve,2021-29460; classtype:web-application-attack; sid:2100260; rev:1;)

Elastic Detection

Elastic EQL rule to detect HTTP POST requests to file upload endpoints with SVG content-type headers:

sequence by source.ip
  [ network where http.request.method == "POST" and
    http.request.body.content_type == "image/svg+xml" and
    http.request.uri contains "upload" or http.request.uri contains "media" or http.request.uri contains "file" ]
  [ network where http.response.status_code == 200 ]

Splunk SPL Query

index=web sourcetype=access_combined 
| where method="POST" AND uri LIKE "%upload%" OR uri LIKE "%media%" OR uri LIKE "%file%"
| rename http_content_type as content_type
| where content_type LIKE "%image/svg+xml%" OR content_type LIKE "%xml%" 
| table _time, src_ip, uri, status, host, http_user_agent, content_type
| sort - _time
| eval alert = "CVE-2021-29460 SVG Upload Attempt"

Wazuh OSSEC Rule

<group name="web, xss, kirby_cve_2021_29460,">
  <rule id="100240" level="12">
    <decoded_as>json</decoded_as>
    <field name="data.method">POST</field>
    <field name="data.uri">\.(upload|file|media)</field>
    <field name="data.content_type">image/svg\+xml</field>
    <description>Kirby CMS SVG upload with potential XSS content detected (CVE-2021-29460)</description>
    <mitre>
      <id>T1190</id>
      <id>T1204.001</id>
    </mitre>
    <group>web_application_attack,xss,</group>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed)

1. Immediate Mitigations:

   • Disable SVG file uploads in all Kirby file blueprints until the patch can be applied. This is the vendor's recommended workaround and fully eliminates the attack vector within the Panel.
   • For frontend forms that accept file uploads, add server-side validation that rejects image/svg+xml content types or files with .svg extensions. Alternatively, add a sanitization step that strips all <script> tags and event handler attributes from any uploaded SVG file.
   • Deploy a Web Application Firewall (WAF) rule that inspects uploaded file content for <script> tags or onload= attributes within SVG files.

2. Patch/Upgrade Steps:

   • Upgrade Kirby CMS to version 3.5.4 or later. This is the official patch version.
   • After upgrading, verify the update by checking the Kirby version via Admin → System or the version() method in the template.
   • If using File::create() for file storage in custom code, verify that the updated Kirby version correctly sanitizes SVG content for that code path.
   • Audit all uploaded SVG files in the media directory for malicious content. Remove any files containing script tags or event handlers. Consider re-downloading legitimate SVG assets from trusted sources if sign-off is required.

3. Long-Term Hardening:

   • Restrict Panel access to only trusted users. Remove editor accounts for users who do not need file-upload privileges.
   • Implement Content Security Policy (CSP) headers that restrict script-src directives. This limits XSS impact even if other vulnerabilities bypass sanitization.
   • Set the Content-Disposition: attachment header for file download routes, forcing files to be downloaded rather than rendered inline. This mitigates direct-file-link XSS.
   • Configure the web server to serve image/svg+xml files with the X-Content-Type-Options: nosniff header and consider blocking direct rendering of SVG files (e.g., via server-side rewrite rules).
   • Perform regular security audits of file-upload validation logic, especially when adding new frontend forms that allow file uploads.
   • Monitor web server logs for patterns matching the Sigma rule above to detect exploitation attempts.

References

1. NVD Entry: CVE-2021-29460 — Official NVD description and CVSS metadata.
2. CNA Advisory: Kirby Security Advisory — XSS via SVG upload — Vendor advisory describing the vulnerability, affected versions, fixtures, and patch guidance for Kirby 3.5.4.
3. Kirby Changelog: Kirby 3.5.4 Release Notes — Official changelog documenting the security fix for SVG upload handling.
4. CVE.org Entry: CVE-2021-29460 — MITRE reference for the CVE record.
5. EPSS Data: FIRST EPSS Score Lookup — EPSS score 0.03174 (86.8th percentile), indicating moderate likelihood of exploitation in the wild.

Threat Actor Campaigns / Exploit-in-the-Wild: No known active campaigns or confirmed exploit-in-the-wild activity were identified in the provided data. The vulnerability was patched in Kirby 3.5.4, released in late March 2021. The absence of public exploit code or CISA KEV listing suggests exploitation remains theoretical but with elevated risk (EPSS 86.8th percentile).