Executive brief
Publify, an open-source publishing platform, is vulnerable to a security flaw where a user with 'publisher' permissions can target administrators. By creating a malicious redirect link, an attacker can execute unauthorized code in the administrator's browser if the administrator clicks the link in the management panel. This could lead to the attacker gaining full administrative control over the website.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Publify (specifically the publify_core engine) due to improper neutralization of input in the redirect functionality. A user with 'publisher' privileges can create a new redirect with a 'javascript:' URI scheme. While the redirect itself may not execute, the administrative dashboard renders this payload within an 'a' tag's href attribute without sufficient sanitization. If an administrator clicks this link in the overview panel, the malicious JavaScript executes in their session context, potentially allowing for privilege escalation. The vulnerability is patched in version 10.0.2.
Affected products
- publify publify_core < 10.0.2
Timeline
- 2025-03-28: advisory
- 2025-03-28: disclosed
- 2025-03-28: patched