CVE-2024-47069: Oveleon Cookiebar XSS Vulnerability

CVE-2024-47069 Overview

CVE-2024-47069 is a reflected cross-site scripting (XSS) vulnerability in Oveleon Cookie Bar, a cookie consent extension for the Contao Open Source CMS. The block/locale endpoint fails to sanitize the user-controlled locale parameter before reflecting it in the HTTP response. An attacker can craft a malicious URL that executes arbitrary JavaScript in a victim's browser when clicked. The flaw affects versions prior to 1.16.3 and 2.1.3, and is tracked under [CWE-79]. The issue is classified as reflected XSS with user interaction required.

Critical Impact
Successful exploitation allows attackers to execute arbitrary script in the context of the Contao backend, enabling session theft, credential harvesting, and unauthorized backend actions.

Affected Products

Oveleon Cookie Bar for Contao versions prior to 1.16.3 (1.x branch)
Oveleon Cookie Bar for Contao versions prior to 2.1.3 (2.x branch)
Contao CMS installations using the vulnerable contao-cookiebar extension

Discovery Timeline

2024-09-23 - CVE-2024-47069 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47069

Vulnerability Analysis

The vulnerability resides in the CookiebarController handling the block/locale route. The controller accepts a locale request parameter and includes its value in the response body without proper output encoding or input validation. Because the response is reflected back to the requesting browser and rendered in a context that permits script execution, an attacker can supply payloads containing HTML or JavaScript to trigger reflected XSS. Exploitation requires a victim to visit a crafted URL, typically delivered via phishing or embedded on an attacker-controlled page.

Root Cause

The root cause is missing input validation on the locale parameter before it is returned in the backend HTTP response. The controller did not verify that the parameter matched a valid locale format, allowing arbitrary strings including active script content to be reflected to the client.

Attack Vector

The attack is network-based and requires user interaction. An attacker crafts a URL targeting the block/locale endpoint with a malicious locale value and lures an authenticated Contao user to open it. When the browser renders the reflected content, injected JavaScript executes with the privileges of the current session. Because the CVSS scope is changed, script execution can affect resources beyond the vulnerable component itself.

php

            throw new PageNotFoundException();
        }

+        if(!Validator::isLocale($locale))
+        {
+            return new Response('The URL must contain a valid locale.', Response::HTTP_BAD_REQUEST);
+        }
+
        $strUrl = $request->get('redirect');

        // Protect against XSS attacks

Source: GitHub commit 1d57470 — the patch adds a Validator::isLocale($locale) check that rejects any non-locale input with an HTTP 400 response before the value reaches the reflected output path.

Detection Methods for CVE-2024-47069

Indicators of Compromise

HTTP requests to /cookiebar/block/locale containing suspicious locale values with HTML tags, <script>, javascript:, or URL-encoded angle brackets (%3C, %3E).
Referer headers pointing to attacker-controlled domains preceding requests to the vulnerable endpoint.
Unexpected outbound requests from Contao backend users' browsers following interaction with cookiebar URLs.

Detection Strategies

Inspect web server access logs for requests to the block/locale route where the locale parameter deviates from expected locale codes such as en, de, or fr_FR.
Deploy web application firewall rules that block reflected XSS payloads targeting query parameters on Contao endpoints.
Correlate authenticated backend sessions with anomalous JavaScript-driven activity such as unexpected AJAX calls or DOM changes.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script execution attempts in the Contao backend.
Monitor Contao installations for the deployed version of oveleon/contao-cookiebar and flag any instance below 1.16.3 or 2.1.3.
Alert on authentication events immediately followed by administrative changes originating from unusual user agents or IPs.

How to Mitigate CVE-2024-47069

Immediate Actions Required

Upgrade oveleon/contao-cookiebar to version 1.16.3 (1.x branch) or 2.1.3 (2.x branch) as documented in GHSA-296q-rj83-g9rq.
Invalidate active Contao backend sessions after patching to reduce risk from previously delivered payloads.
Review backend user accounts for unauthorized changes, particularly to administrator roles and content records.

Patch Information

The vendor released fixed versions 1.16.3 and 2.1.3. The patch introduced in commit 1d57470 enforces locale validation via Validator::isLocale($locale) and returns an HTTP 400 response for invalid input, preventing reflection of attacker-controlled data.

Workarounds

If immediate upgrade is not possible, restrict access to the Contao backend using IP allowlists or VPN-only access.
Deploy WAF rules that reject requests to block/locale when the locale parameter contains characters outside [A-Za-z_].
Apply a strict Content Security Policy that disallows inline scripts on Contao backend responses, as recommended in the OWASP XSS Prevention Cheat Sheet.

bash

# Update via Composer to a patched release
composer require oveleon/contao-cookiebar:^2.1.3
# Or for the 1.x branch
composer require oveleon/contao-cookiebar:^1.16.3
composer install --no-dev --optimize-autoloader