CVE-2021-41252

Executive Summary

CVE-2021-41252 is a stored cross-site scripting (XSS) vulnerability in Kirby CMS's writer field, affecting all versions prior to 3.5.8. The flaw allows authenticated Panel users to inject malicious HTML into content files via direct API requests, bypassing the Panel's client-side protections, resulting in script execution in the browsers of both site visitors and logged-in users. With a CVSS score of 7.3, the vulnerability requires authenticated access (privilege level of a Panel user) but can lead to arbitrary API calls performed with the victim's permissions, potentially enabling account takeover, data exfiltration, or further administrative compromise.

Technical Analysis

Kirby is an open-source file-structured CMS. The vulnerability resides in the writer field type, introduced in Kirby 3.5.x as a rich text editor. The writer field stores formatted content as HTML code directly in the content files. Unlike other field types that automatically escape HTML special characters to prevent XSS, the writer field cannot escape such characters without losing the rich-text formatting functionality (e.g., bold, italic, links, headings).

The core security weakness is that the writer field did not securely sanitize contents on save. The attack surface is Kirby's API endpoints, which allow direct modification of content files without going through the Panel's UI (which includes client-side sanitization mechanisms). An authenticated Panel user can craft a direct API request containing malicious HTML code (e.g., <script> tags, event handler attributes, or obfuscated payloads) and submit it as the writer field's content. Since the backend does not sanitize this input during the save operation, the malicious HTML is written verbatim into the content file.

When the content file is rendered by the site frontend, the unsanitized HTML is displayed to site visitors and logged-in users browsing the site. Because the payload executes in the victim's browser context, it inherits the victim's session and cookie information.

On the backend, Kirby 3.5.8 introduced sanitization of all writer field contents whenever content is modified via the API. This means the fix is applied at the server-side persistence layer rather than relying on client-side defenses.

Technical details such as specific API endpoints or function names are not disclosed in the NVD description. The vulnerability is confined to installations that use the writer field type; sites that do not implement this field are not affected.

Exploitation Scenarios

Preconditions:

• Attacker must be an authenticated Panel user (i.e., has account credentials for the CMS admin panel).
• Target site must use the writer field type in at least one blueprints/page model.
• Target site must be running Kirby < 3.5.8.

Reconnaissance / Target Identification:

1. The attacker identifies a Kirby CMS instance by fingerprinting HTTP responses (e.g., X-Powered-By headers, HTML comments, or specific assets referenced in the page source such as /media/ paths or Kirby-specific panel URLs).
2. The attacker confirms the writer field is active by inspecting the site's frontend for rich text elements (e.g., formatted paragraphs with embedded links) or by viewing the page blueprint if the site exposes it.

Exploitation Trigger: 3. The attacker authenticates to the Kirby Panel using valid credentials (low-privilege editor or author account is sufficient — the vulnerability does not require administrative rights). 4. Instead of using the Panel's UI (which may enforce client-side sanitization), the attacker crafts a direct HTTP request to Kirby's API, targeting the content file associated with a page that contains a writer field. The request includes a payload in the form of malicious HTML.

Payload / Execution Method: 5. A classic payload at the vulnerability class level would include a JavaScript-bearing HTML tag — for example, embedding a <script> block or an event handler attribute (e.g., onload, onerror, onmouseover) that executes JavaScript when the content is rendered in the browser. 6. The backend, lacking sanitization, writes the raw HTML into the content file via the API without modification.

Post-Exploitation Impact: 7. When any user (site visitor or authenticated Panel user) loads the affected page, the malicious script executes in their browser context. 8. For logged-in Panel users, the script can make authenticated requests to Kirby's API using the victim's session, enabling actions such as modifying page content, altering settings, or exfiltrating sensitive data — all appearing to originate from the legitimate user. 9. For unauthenticated visitors, the script can perform actions on the site such as phishing redirection, cryptocurrency mining, credential harvesting via fake login overlays, or session hijacking if session tokens are accessible.

No public PoC is available; the attack chain described above is inferred from the vulnerability class and the NVD description.

Impact Assessment

Business Impact:

• Confidentiality Impact: HIGH — An attacker can leverage the XSS to make authenticated API requests on behalf of a victim user, potentially accessing internally stored content, user lists, and site configuration data.
• Integrity Impact: NONE (per vector) — The CVSS vector specifies no integrity impact, though in practice content modification could occur via victim-session API calls; the official scoring reflects the primary flaw.
• Availability Impact: NONE (per vector) — No direct denial-of-service or availability degradation is described.

Affected Systems:

• Any Kirby CMS installation using the writer field type, version < 3.5.8.
• Installation's frontend visitors and authenticated Panel users are the affected targets.

Blast Radius:

• Moderate-to-high for multi-user CMS environments. Because the attacker needs authenticated Panel access, the pool of potential attackers is limited to current or former staff, contractors, or compromised accounts. However, the downstream impact extends to every site visitor, making the business harm potentially substantial (reputational damage, legal liability from compromised visitor data, regulatory fines).

CVSS Context:

• Vector: AV:N/AC:L/PR:L/UI:N/S:C — Network attack vector, low attack complexity, low privileges required (authenticated Panel user), no user interaction required, and scope change (the vulnerable component affects other system components — i.e., the victim's browser and API context).

Detection Guidance

The following detection artifacts are hypothesis-based, as no PoC is publicly available. They target the observable behavior of exploiting this XSS via Kirby's API.

Sigma Rule

title: Kirby CMS Writer Field XSS via API - Content File Modification
id: 9f2c1833-4df7-4a2b-8a6a-91c5b4da7e44
status: experimental
description: Detects API requests to Kirby CMS that contain suspicious HTML/JavaScript payloads in writer field content, potentially indicating CVE-2021-41252 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-41252
author: Valtersit SOC
date: 2025/01/15
logsource:
    category: webserver
    product: nginx
    definition: 'Looks for suspicious requests to Kirby API endpoint'
detection:
    selection:
        cs-method: 'POST|PUT|PATCH|DELETE'
        cs-uri-query|contains:
            - 'api'
            - 'pages'
            - 'content'
    selection_payload:
        cs-uri-query|contains|all:
            - 'writer'
        cs-request-body|contains|any:
            - '<script'
            - 'javascript:'
            - 'onload='
            - 'onerror='
            - 'onmouseover='
            - 'document.cookie'
            - 'fetch('
            - 'XMLHttpRequest'
    condition: selection and selection_payload
falsepositives:
    - Legitimate rich text content containing links or formatting could match partial patterns
level: high

YARA Rule

rule Kirby_Writer_Field_XSS_Payload {
    meta:
        author = "Valtersit SOC"
        description = "Detects common XSS payloads in Kirby writer field content that may indicate CVE-2021-41252 exploitation"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2021-41252"
        date = "2025-01-15"
        severity = "high"
    strings:
        $script_tag = "<script" ascii nocase
        $event_handler1 = "onload=" ascii nocase
        $event_handler2 = "onerror=" ascii nocase
        $event_handler3 = "onmouseover=" ascii nocase
        $js_protocol = "javascript:" ascii nocase
        $cookie_access = "document.cookie" ascii nocase
        $fetch_call = "fetch(" ascii nocase
        $img_tag = "<img" ascii nocase
    condition:
        uint16(0) == 0x0A0D or (filesize < 5MB and any of them)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"KIRBY CMS Writer Field XSS Attempt (CVE-2021-41252)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"api"; http.uri; content:"pages"; http.uri; content:"content"; http.request_body; pcre:"/(?i)<script|javascript:|onload=|onerror=|onmouseover=|document\.cookie|fetch\(|XMLHttpRequest/"; classtype:web-application-attack; reference:cve,2021-41252; sid:1000189; rev:1;)

Elastic Detection

sequence by host.id with maxspan=1s
  [ network where event.type == "start" and destination.port == 443
  ] by process.entity_id
  [ http where event.category == "web" and http.request.method in ("POST","PUT","PATCH")
      and http.request.body.content : (
          "*<script*",
          "*javascript:*",
          "*onload=*",
          "*onerror=*",
          "*onmouseover=*",
          "*document.cookie*",
          "*fetch(*",
          "*XMLHttpRequest*"
      )
      and http.request.uri : ("*api*", "*pages*", "*content*")
  ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method IN ("POST","PUT","PATCH","DELETE")
| search uri="*api*" OR uri="*pages*" OR uri="*content*"
| regex _raw="(?i)(<script|javascript:|onload=|onerror=|onmouseover=|document\.cookie|fetch\(|XMLHttpRequest)"
| stats count by src_ip, uri, http_user_agent, status
| sort -count

Wazuh OSSEC Rule

<group name="web_application_attacks,">
  <rule id="100189" level="10">
    <decoded_as>web</decoded_as>
    <match>POST|PUT|PATCH</match>
    <match>api|pages|content</match>
    <regex>(?i)(&lt;script|javascript:|onload=|onerror=|onmouseover=|document\.cookie|fetch\(|XMLHttpRequest)</regex>
    <description>Kirby CMS Writer Field XSS attempt (CVE-2021-41252)</description>
    <group>web_application_attack,xss,</group>
    <mitre><id>T1190</id></mitre>
    <references>https://nvd.nist.gov/vuln/detail/CVE-2021-41252</references>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED (single source claims patch, not independently confirmed).

1. Immediate Mitigations (if patch cannot be applied immediately):

   • Restrict authenticated Panel user accounts to the minimum necessary privileges; audit and remove inactive or dormant accounts that have Panel access.
   • Disable the writer field on all blueprints where it is not strictly required, replacing with alternative field types (e.g., textarea, markdown, or text fields that support server-side escaping).
   • Implement a Web Application Firewall (WAF) rule to block API requests that contain HTML/JavaScript payloads in the request body.
   • Monitor and alert on API requests from authenticated Panel users, particularly those that modify content files directly.

2. Patch/Upgrade Steps:

   • Upgrade Kirby CMS to version 3.5.8 or later (the earliest patched release).
   • After upgrading, verify the fix by attempting to submit a test payload via the API and confirming the backend sanitizes the content before persistence.
   • Verify that existing content files that may have been compromised prior to patching are sanitized. Review content files for unexpected HTML/script tags; re-save any affected content to trigger the new sanitization logic.

3. Long-Term Hardening:

   • Implement a Content Security Policy (CSP) that disallows inline script execution (script-src 'self') across the site frontend as a defense-in-depth measure.
   • Regularly audit Panel user activity and permissions; enforce least-privilege principles.
   • Keep Kirby CMS updated to the latest stable release; monitor Kirby's security advisory mailing list for new disclosures.
   • Consider enabling web application firewall (WAF) rules that inspect API traffic for common payload signatures.
   • Perform periodic security scanning of content files for anomalous HTML or script tags.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2021-41252 — Official NVD reference with description, CVSS score, and affected product information.
2. Kirby Advisory (inferred): Kirby 3.5.8 release notes and security advisory — CNA source confirming the patch that sanitizes writer field content on the backend. Note: The exact URL is not provided in the intelligence data; refer to Kirby's official changelog at getkirby.com.
3. CISA KEV: Not listed — CVE-2021-41252 is not currently in the Known Exploited Vulnerabilities catalog.
4. GitHub Advisory (inferred): Likely containing the CNA-issued advisory and patch details — verify via GitHub Security Advisories for kirby. Note: Exact URL not provided in the intelligence data.

Threat Actor Campaigns / Exploit-in-the-Wild Evidence:

• No public evidence of exploitation in the wild exists for this vulnerability. The PoC status is UNKNOWN, and no exploit code or Nuclei template has been publicly released. The EPSS score of 0.00898 (56.4th percentile) suggests a very low probability of exploitation in the near term, though this CVE is somewhat more likely to attract attention than the average vulnerability given its percentile ranking among scored CVEs.