CVE-2024-24570: Statamic CMS XSS Vulnerability

CVE-2024-24570 Overview

CVE-2024-24570 is a stored Cross-Site Scripting (XSS) vulnerability in Statamic, a Laravel and Git powered content management system. Attackers can upload HTML files disguised as JPG images through asset fields that lack mime type validation. The flaw affects front-end forms with asset fields, asset fields in the control panel, and the asset browser in the control panel. When an authorized user triggers the crafted payload, attackers can execute arbitrary JavaScript in that user's browser session. A specifically crafted payload can abuse the copy password reset link feature to steal a user's reset token and take over their account. Statamic patched the issue in versions 4.46.0 and 3.4.17.

Critical Impact
Successful exploitation allows account takeover of control panel users through theft of password reset tokens, enabling unauthorized access to CMS content and administrative functions.

Affected Products

Statamic CMS versions prior to 3.4.17 (3.x branch)
Statamic CMS versions prior to 4.46.0 (4.x branch)
Laravel-based deployments using Statamic asset fields and control panel

Discovery Timeline

2024-02-01 - CVE-2024-24570 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24570

Vulnerability Analysis

The vulnerability is a stored XSS flaw classified as [CWE-79]. Statamic's asset upload handlers rely on file extension checks rather than inspecting actual file content or MIME type. An attacker can craft an HTML document containing JavaScript and rename it with a .jpg extension. The server accepts the file as an image and stores it within the asset library.

When the control panel or a front-end page later renders the asset, the browser interprets the content as HTML and executes the embedded script. Because the script runs in the context of an authenticated session, it inherits the privileges of the viewing user. The EPSS score of 0.734% reflects moderate interest from exploitation prediction models.

The secondary impact involves the copy password reset link feature. A tailored payload can read the reset token exposed through this functionality and exfiltrate it to an attacker-controlled endpoint. Possession of the token enables full account takeover without requiring the victim's current credentials.

Root Cause

The root cause is missing MIME type validation on uploaded assets. Statamic's upload pipeline trusts the client-supplied file extension and does not verify the magic bytes or the server-detected content type. This permits polyglot files that satisfy image-extension checks while rendering as HTML in browsers.

Attack Vector

Exploitation requires network access to a Statamic instance that exposes asset uploads, either through a public front-end form or control panel access. The attacker uploads a malicious HTML file with an image extension. User interaction is required: an authenticated user must open or preview the uploaded asset for the payload to fire. The scope changes because the injected script executes in the context of the Statamic application, affecting resources beyond the initial upload boundary.

No verified public exploit code was referenced in the advisory. See the GitHub Security Advisory GHSA-vqxq-hvxw-9mv9 and the Packet Storm XSS Vulnerability write-up for technical details.

Detection Methods for CVE-2024-24570

Indicators of Compromise

Asset files with image extensions (.jpg, .jpeg, .png) whose contents begin with <html>, <script>, or other HTML tokens
Outbound HTTP requests from control panel user sessions to unfamiliar domains shortly after an asset is previewed
Unexpected password reset events for administrative accounts, especially following asset interactions
Access log entries showing control panel users loading newly uploaded asset URLs returning Content-Type: text/html

Detection Strategies

Scan the asset storage directory for files whose declared extension does not match their detected MIME type using tools such as file or mime-type libraries
Review web server access logs for asset responses served with HTML content types instead of image types
Monitor Statamic audit logs for password reset token generation events correlated with recent asset views
Alert on anomalous JavaScript execution originating from asset subpaths in browser-side telemetry

Monitoring Recommendations

Enable verbose logging in the Statamic control panel for asset uploads, previews, and user management actions
Forward web server and application logs to a centralized analytics platform for correlation across upload and session events
Track administrator session activity for unusual API calls to password reset endpoints
Baseline normal asset content types and alert on deviations such as HTML or JavaScript stored under image extensions

How to Mitigate CVE-2024-24570

Immediate Actions Required

Upgrade Statamic to version 4.46.0 for the 4.x branch or 3.4.17 for the 3.x branch
Audit existing asset directories for files whose contents do not match their declared extension and remove suspicious uploads
Rotate credentials and invalidate active sessions for control panel users who may have previewed malicious assets
Review recent password reset activity and reset tokens issued since the vulnerable version was deployed

Patch Information

Statamic released fixes in versions 4.46.0 and 3.4.17. The patch adds MIME type validation to asset uploads and disables the copy password reset link functionality that enabled the account takeover escalation. Refer to the GitHub Security Advisory GHSA-vqxq-hvxw-9mv9 and the Full Disclosure Security Update for full remediation guidance.

Workarounds

Restrict control panel access to trusted networks via firewall or VPN until patching is complete
Disable public front-end forms that accept asset uploads from unauthenticated users
Serve the asset storage directory with a strict Content-Security-Policy that blocks inline script execution
Configure the web server to force a non-HTML Content-Type header on files served from the asset path

bash

# Configuration example
# Upgrade Statamic via Composer
composer require statamic/cms:^4.46.0

# Verify installed version
php please --version