Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting
Date: 2024-09
Affected: composer/filament/infolists, composer/filament/tables
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2024-47186
CWE: CWE-79
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

### Summary If values passed to a `ColorColumn` or `ColumnEntry` are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered. Versions of Filament from v3.0.0 through v3.2.114 are affected. Please upgrade to Filament [v3.2.115](https://github.com/filamentphp/filament/releases/tag/v3.2.115). ### PoC For example, using a value such as: ```html blue;"><script>alert('There\'s a security problem here')</script style=" ``` Would get passed into the `@style()` Blade directive from Laravel to render the correct background color, where `$state` contains the value: ```blade <div @style([ "background-color: {$state}" => $state, ])></div> ``` Since Laravel does not escape special characters within the `@style` Blade directive, the effective output HTML would be: ```html <div style="background-color: blue;"><script>alert('There\'s a security problem here')</script style=""></div> ``` Creating the opportunity for arbitrary JS to run if it was stored in the database. ### Response This vulnerability (in `ColorColumn` only) was reported by @sv-LayZ, who reported the issue and patched the issue during the evening of 25/09/2024. Thank you Mattis. The review process concluded on 27/09/2024, which revealed the issue was also present in `ColorEntry`. This was fixed the same day and Filament [v3.2.115](https://github.com/filamentphp/filament/releases/tag/v3.2.115) fol


Mitigations:

Architectural layers (MAESTRO):