GitHub Security Advisory: GHSA-4mgv-366x-qxvx
Package: craftcms/cms (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.0.0-RC1, < 4.17.0-beta.1
Patched in: 4.17.0-beta.1

Summary: Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options

Details:
## Overview of all XSS Reports

Multiple stored XSS vulnerabilities were found in Craft CMS. They were split into **4 reports** as follows:

| Report | What's Vulnerable | Why Separate |
|--------|-------------------|--------------|
| **This Report (1)** | Multiple settings names | Twig Template: `_includes/forms/checkbox.twig` |
| **Report 2** | Entry Types Name | Twig Template: `_includes/forms/editableTable.twig` |
| **Report 3** | Card Attributes in Field Layout | `helpers/Cp.php` |
| **Report 4 (Commerce)** | Product Type Name | Source in Commerce, sink in CMS - will report this one via Commerce GHSA |

Reports 2, 3, and 4 are clearly distinct locations. For this report (Report 1), it was not clear whether to split or consolidate these 7 bugs. The bug report was consolidated and the final categorization should be left to the judgement of the user.

**Note:** This overview is only in this Report. Other reports only reference this one.

---
## Summary

Stored XSS in multiple settings. Names/labels are rendered without sanitization via `checkbox.twig` template which uses `{{ label|raw }}`.

---
## Affected Sources

| #   | Source (injection point)                                                 | Sink (where payload reflects)                 |
| --- | ------------------------------------------------------------------------ | --------------------------------------------- |
| 1   | Section Name (`/admin/settings/sections`)                                | Entries field -> Sources checklist            |
| 2   | Volume Name (`/admin/settings/assets/volumes/{vol_id}`)                  | Assets field -> Sources checklist             |
| 3   | User Group Name (`/admin/settings/users/groups`)                         | Users field -> Sources, User permissions page |
| 4   | Global Set Name (`/admin/settings/globals`)                              | User permissions page                         |
| 5   | Generated Fields Name (Volumes, Users, etc.)                             | Card Attributes checkboxes                    |
| 6   | Checkboxes & Radio Buttons Field Option Label (`/admin/settings/fields`) | User profile pages                            |
| 7   | Custom Sources Label (`/admin/users` -> Customize Sources)               | Users field -> Sources checklist              |

---
## Proof of Concept

### Required Permissions (Attacker)
- Admin access
- `allowAdminChanges` is enabled in production, which is against our [security recommendations](https://craftcms.com/knowledge-base/securing-craft).

### Bugs 1-3: Section, Volume, User Group Names

1. Log in as admin.
2. Inject payload in one of these:
   - **Settings** -> **Sections** -> Create/edit section -> **Name**
   - **Settings** -> **Assets** -> **Volumes** -> Create/edit volume -> **Name**
   - **Settings** -> **Users** -> **User Groups** -> Create/edit group -> **Name**
3. Set **Name** to:
```html
<img src=x onerror="alert('XSS')">
```
4. Save.
5. Go to **Settings** -> **Fields** -> Create