CVE-2023-38488

Executive Summary

CVE-2023-38488 is a field injection vulnerability in the KirbyData text storage handler of the Kirby content management system (CMS), affecting all versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6. The vulnerability allows attackers with content write access—either authenticated Panel users or external visitors permitted to update content files (e.g., via contact or comment forms)—to overwrite content fields that site developers did not intend to be modified. Exploitation can lead to site content alteration, site behavior disruption, or injection of malicious data or code. The vulnerability carries a CVSS score of 7.1 (High) and does not require a valid CVE entry in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Technical Analysis

Kirby is a file-based content management system that stores site, page, file, and user content in plaintext files by default. These files use the KirbyData format, which delimits individual content fields using newline characters followed by a line containing four dashes (----). The parsing mechanism splits the file contents into distinct fields by locating this separator sequence.

The vulnerability resides in the interaction between the Unicode Byte Order Mark (BOM) removal logic and field separator escaping during file read/write operations. According to the NVD description, when reading a KirbyData file, the affected code first removes the Unicode BOM sequence from the file contents and subsequently splits the content into fields by the field separator. Conversely, when writing to a KirbyData file, field separators contained within field data are escaped to prevent user-supplied input from interfering with the field structure.

The critical flaw is that this escaping mechanism could be bypassed by including a Unicode BOM sequence within a field separator string—for example, --\xEF\xBB\xBF--. The BOM bytes \xEF\xBB\xBF represent the UTF-8 encoding of the Unicode code point U+FEFF (ZERO WIDTH NO-BREAK SPACE). When the file is subsequently read, the BOM-removal preprocessing step strips the BOM sequence from the file content. This stripping operation effectively normalizes the crafted separator --\xEF\xBB\xBF-- into the canonical ---- separator after the write-time escaping has already been applied. Consequently, a field separator embedded within user-controlled content that was intended to be escaped survives the read-time normalization and is treated as a legitimate field boundary.

This is a classic injection vulnerability of the type described in the NVD entry: "a field injection in a content storage implementation is a type of vulnerability that allows attackers with content write access to overwrite content fields that the site developer didn't intend to be modified." The attack mechanism leverages the discrepancy between the write-time escaping logic (which checks for the literal ---- sequence) and the read-time BOM-stripping logic (which modifies sequences containing BOM bytes after escaping has been applied). The net effect is that an attacker can inject additional field separators into stored content, allowing them to create new fields or alter the structure of the content file beyond what the developer intended.

The exact security impact depends on the field type and how the modified fields are used downstream—for example, injecting data into fields that are rendered without proper sanitization could lead to stored cross-site scripting (XSS), while overwriting configuration-adjacent fields could break site functionality or alter access control.

Exploitation Scenarios

Based on the NVD description, the following attack chain is inferred. Note: No public PoC is available at the time of writing; the attack chain is inferred from the vulnerability class and description.

Step 1: Reconnaissance and Target Identification An attacker identifies a Kirby CMS instance by fingerprinting HTTP response headers, page source comments, or distinctive Kirby panel URLs (/panel, /media, etc.). The attacker then determines whether the site exposes any content-write functionality: either authenticated Panel user credentials are obtained (via credential stuffing, phishing, or other means), or the site surface includes public-facing forms (contact forms, comment sections, or other user-submission endpoints) that write data to Kirby content files.

Step 2: Triggering the Vulnerability Class Once write access is established, the attacker submits content containing a crafted field separator that includes a Unicode BOM sequence—e.g., --\xEF\xBB\xBF--—within a text field or content block. The vulnerable storage handler fails to detect this as a field delimiter during write-time escaping (because the literal four-dash sequence is not present after the BOM bytes are inserted), and writes the data to the KirbyData file unescaped.

Step 3: Payload and Execution Method The malicious payload consists of the BOM-injected separator followed by additional field name/value pairs. When the KirbyData file is later read by any component of the CMS, the BOM-removal preprocessing strips the \xEF\xBB\xBF bytes, normalizing the crafted separator to the canonical ---- delimiter. The parsing logic then treats the attacker-controlled content as legitimate field boundaries, causing arbitrary fields to be created or existing fields to be overwritten. The attacker can inject data into fields that were not intended to be user-modifiable—potentially including fields that influence page rendering, site configuration, or application behavior.

Step 4: Post-Exploitation Impact Depending on the field type and downstream usage, the attacker can: (a) alter site content to deface pages or inject misleading information; (b) break site behavior by corrupting structural fields; (c) inject malicious data or code—if the overwritten field is rendered without output encoding, this can escalate to stored XSS, potentially enabling session hijacking, credential theft, or further compromise of admin accounts; or (d) in scenarios where fields control business logic, manipulate site functionality in other unintended ways.

Impact Assessment

Business Impact: The vulnerability enables content integrity compromise on affected Kirby sites. An attacker who can write to content files (either as a low-privileged Panel user or via public forms) can manipulate stored content fields beyond the application designer's intended boundaries. This can result in website defacement, SEO poisoning, injection of malicious content viewed by visitors, or disruption of site functionality. The CVSS vector reflects a combination of low confidentiality impact (possible data exposure through altered output), high integrity impact (arbitrary field overwrite), and low availability impact (potential site breakage).

Affected Systems: All Kirby CMS installations running versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 that permit write access from untrusted users—either through authenticated Panel accounts considered potentially hostile or through public-facing forms that trigger content file updates. Sites that do not allow write access for untrusted users or visitors are explicitly noted in the NVD description as unaffected.

Blast Radius: The NVD description states that "The exact security risk depends on the field type and usage." A conservative assessment places the risk at medium-to-high for sites with public write access, since content files in Kirby often include fields that feed into template rendering. The attack requires no network traversal or special protocol knowledge beyond crafting a BOM-containing separator string; the only prerequisite is content write access. Given the CVSS score of 7.1 (High), organizations running affected versions with public-facing write endpoints should treat this as a priority remediation item.

Detection Guidance

Sigma Rule

title: Potential Kirby Field Injection via BOM-Containing Separator
id: 6a5e9c21-3d46-4c08-9b71-5d4f2a8c1d03
status: experimental
description: Detects submission data containing BOM-encoded field separator sequences that may indicate attempted KirbyData field injection.
logsource:
  category: application
  product: web
detection:
  selection_bom_separator:
    - keywords:
        - '*--\xEF\xBB\xBF--*'
        - '*--%EF%BB%BF--*'
        - '*\uFEFF--*'
  condition: selection_bom_separator
fields:
  - client_ip
  - http.user_agent
  - url.original
  - request_body
falsepositives:
  - Legitimate content submissions that naturally contain BOM characters in the data stream (rare)
level: medium
tags:
  - attack.t1190
  - cve.2023.38488

YARA Rule

rule Kirby_Field_Injection_BOM_Separator
{
    meta:
        author = "ValterSIT Threat Intel"
        description = "Detects KirbyData file content containing BOM-encoded field separator sequences"
        cve_id = "CVE-2023-38488"
        date = "2024-01-15"
        severity = "high"
    strings:
        $bom_separator = { 2D 2D EF BB BF 2D 2D }  // --\xEF\xBB\xBF--
        $bom_short = { 2D 2D EF BB BF }             // --\xEF\xBB\xBF
        $bom_encoded = { 2D 2D 25 45 46 25 42 42 25 42 46 2D 2D } // --%EF%BB%BF--
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET WEB_SPECIFIC_APPS Kirby CMS Field Injection Attempt (CVE-2023-38488)";
    flow:established,to_server;
    content:"--\xEF\xBB\xBF--";
    nocase;
    sid:202338488;
    rev:1;
    metadata:attack_target Web_Server, deployment Perimeter, signature_severity Major, created_at 2024_01_15;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2023-38488;
    classtype:web-application-attack;
)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where event.type == "start" and destination.port == 443]
  [http where http.response.status_code < 400 and
     (url.query or request.body or postbody) matches "*--\xEF\xBB\xBF--*"]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis
| where match(_raw, "--\xEF\xBB\xBF--") OR match(_raw, "--%EF%BB%BF--")
| stats count by src_ip, uri, http_user_agent, _time
| sort - _time

Wazuh OSSEC Rule

<rule id="100384" level="12">
  <if_sid>31100</if_sid>
  <match>--\xEF\xBB\xBF--</match>
  <description>Potential Kirby CMS field injection attempt (CVE-2023-38488)</description>
  <group>web_application_attack,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
  <options>no_full_log</options>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED. The CNA has claimed fixed versions exist (3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6), but this claim has not been independently confirmed by a second source. Organizations should verify the patch availability and integrity before deployment.

1. Immediate Mitigations (if upgrade is not immediately possible):

• Disable write access for untrusted users: restrict content file write permissions to only fully trusted administrators.
• Remove or disable public-facing forms that trigger content file updates (contact forms, comment forms, etc.) until patched.
• Implement a web application firewall (WAF) rule to block requests containing the BOM-encoded separator pattern (--\xEF\xBB\xBF-- or URL-encoded variants).
• Monitor content files for unexpected field structure changes or anomalies in file modification activity.

2. Patch/Upgrade Steps:

• Upgrade Kirby CMS to the latest patched version corresponding to your release branch: 3.9.6 (latest stable), or 3.8.4.1, 3.7.5.2, 3.6.6.3, 3.5.8.3 for older branches.
• Verify the integrity of the downloaded package against the vendor's published checksums.
• After upgrade, review all content files for any previously injected separators and audit file modification times for unusual activity.
• Test the patched version in a staging environment before production deployment.

3. Long-Term Hardening:

• Review and minimize the set of users granted Panel write access; implement principle of least privilege.
• If third-party forms write to Kirby content files, ensure the form handler validates and sanitizes all input against field separator characters and BOM sequences.
• Implement file integrity monitoring (FIM) on content directories to alert on unexpected file structure changes.
• Maintain a regular patching cadence for CMS and supporting components.
• Monitor CISA KEV and CVE feeds for any updates to exploitation activity or patch confirmation.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2023-38488
2. Kirby CMS Security Advisory — https://getkirby.com/security (vendor advisory section for CVE-2023-38488)
3. CWE-74: Improper Neutralization of Special Elements — https://cwe.mitre.org/data/definitions/74.html
4. Kirby CMS Official Website — https://getkirby.com (for version release notes and patch downloads)
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2023-38488 not currently listed) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No known threat actor campaigns or exploit-in-the-wild activity have been reported for CVE-2023-38488 as of the latest intelligence review. The EPSS score of 0.00924 (57.2% percentile) indicates a moderate likelihood of exploitation in the wild based on current threat intelligence, but no confirmed active exploitation has been documented. CISA KEV does not list this CVE, meaning no federal civilian executive branch agencies are currently mandated to remediate it under Binding Operational Directive 22-01.